If you can use Amber (or another decoupled app), use that. Browser extensions have access to all content of a tab (given you've secured it) when enabled, and thus are the perfect entry point for malware.