No, extensions are tied to the browser sandbox and they also have to specify their permissions beforehand. They can request fairly wide permissions inside the browser sandbox, yes, but they have to explicitly list the permissions they require in the manifest and the browser will ask you if you're fine with those before installing. Outside of the browser itself, the extensions can't do pretty much anything outside of sending messages to applications that explicitly register to receive them from them.