@feld @gsderp I don't understand how it could talk about security or integrity otherwise but I am open to the possibility I am wrong. I am highly skeptical of this.

the way that extensions like userscripts work is interesting because they can modify the dom at a higher layer that is invisible to the web application while still presenting the modified content to the user (it's possible to leak existence of your script though) so you could have an extension that for example does css changes to a secured webpage that isn't any serious risk of violating the sandbox. this can be determined by the extension manifest so I could see a future where google allows arbitrary extensions that can modify any webpage in this way, but then there's other classes of extensions that won't work on a locked down page unless it's gone through an audit by google and approved as an extension in their store.