> they don't want people injecting javascript on their website

They should send an email to every extension author ever, and maybe even browser vendors for supporting such a malicious feature.