This type of thing is all too common. We wrote about a worse case last year where an extension XSS'd quite literally the entire internet: https://www.tinfoilsecurity.com/blog/building-a-browser-exte...

The scariest thing here is that you have arbitrary code execution, so your options are limitless. Check out XSS Harvest: https://github.com/Miserlou/XSS-Harvest