XSS in Gmail through Rapportive (opens in new tab)

Agreed. I read "extension that alters or scrapes pages you visit" and I hear "quick and dirty hack that does nearly-blind poking around in a foreign DOM tree that could change at any time." It doesn't exactly inspire confidence that someone who would rely on such a fragile technique would put a ton of thought into security.

What i'd like to see, and as far as i know it doesn't exist in any browser, is a way to prevent any extensions from running on certain sites. I want some things like adblock installed for general browsing, but there's no reason i need it running on my email, my banking, my employer's control panel. I can white-list sites inside of extensions, but that still leaves me trusting the extension to properly implement their white-listing feature. I'd much rather have chrome managing a list of sites where the extension doesn't get to run at all.