2. Desktop platforms do not universally sandbox applications (though they are trying). You can install a desktop app that steals all the data in your home directory, including your entire browsing history, with no permission dialog whatsoever.
3. That aside, browsers sandbox extensions just like mobile applications. One extension cannot access another extension's data.
4. Furthermore, by default, a browser extension can only access content from its own origin. It is in fact sandboxed from the rest of the sites you visit.
5. If the user grants permission, a browser extension may access other sites.
So in short, browser extensions are in fact sandboxed.
And your idea of mobile apps accessing data is entirely dependent on the qualifier "when they shouldn't", which, arguably if given permission, they should so it's a moot point.
The vast majority of extensions require the ability to read and modify the dom on any website to do anything. This is so much worse than the average app permissions.
