All extensions with access to the DOM can steal passwords. That's the argument used for restricting sideloading, etc.

(Can they steal Basic-auth passwords, though?)