Browser extensions have the ability to read the text on every page you go to and send that data to remote servers. They also have the ability to monitor keystrokes. They could easily read a url, and listen for you typing a username and password. This is significantly more risky than just “browsing the web.”
There are many malicious browser extensions masquerading as legitimate extensions.