VULNERABILITY DETAILS
The Chrome extension can copy the text in the textbox without any permissions in the manifest.json file. This can be dangerous and can send the data to a web server.

Here the Chrome extension developer guide said you must got this
https://developer.chrome.com/extensions/permission_warnings
"clipboardRead" permission
Allows the extension to use the following editing commands with document.execCommand():
"copy"
"cut"


VERSION
Chrome Version: 60.0.3112.101  + stable
Operating System: MacOS Sierra 10.12.6

REPRODUCTION CASE
1. Unzip the Chrome extension to a folder
2. Load the Chrome extension
3. Click on the extension icon, you see the popup
4. Now you see a textbox with a text. If you click copy, it copy the text to your memory
5. If possible, you see the successful message

But important is that this Chrome extension go no "permission" in the manifest file. So normal it must show you an error. 
Now this can be dangerous, because the user information can be posted on sever. Without knowing this Chrome extension just copy an (important) data.


 

Deleted: extension.zip 53.7 KB

extension.zip 53.7 KB Download