Description
Via message passing, extensions can let scripts running in webpages get access to sensitive APIs, such as executing code in the context of the extension, making XMLHttpRequest from the context of the extension and getting the response back, storing data in the context of the extension and retrieving it back later on or triggering the download of arbitrary files on the user computer

Steps to reproduce: Let consider the https://addons.opera.com/en/extensions/details/smaily-dlia-odnoklasnikov/ extension

1. Install it

2. Navigate to https://ok.ru for instance and open the browser console.

3. Send the appropriate message (JavaScript code) to the extension background page

   chrome.runtime.sendMessage("pmpnemphhmmpkcafgpdjanghiaadfbef", {
   			action: "getRemote",
   			url: "https://mail.google.com",
   			blob: null, // Or with data
   		}, function(response){
       console.log("DATA", response);
   });
   

4. If you are logged into your gmail account, the extension reads your emails and displays them in the console. You can replace https://mail.google.com by any URL, the extension will fetch its content and return it back

I have more extensions (around 10) of them, but I cannot upload files.

What should have happened
We think that extensions review process should take into consideration the possibility that extensions let web applications access their privileges APIs. This is a violation of privilege separation between extensions and web applications, and have tremendous consequences: SOP bypass, the execution of arbitrary codes in the context of the extension, access to user cookies, browsing history, access to extensions storage, triggering of downloads, etc.