While web pages are constrained by the security model of the web browser (in particular, the same-origin policy), extensions are not. As a result, a malicious browser extension may take action against the interest of the user that installed it. Such browser extensions are a form of malware.