And they execute within the context of the page you're currently viewing, which prevents malicious cross-site behavior like that of this extension.