If the evil extension only has access to mail.google.com, what is blocking it from sending an email with your google-password?
If the evil extension only has access to mail.google.com, what is blocking it from sending an email with your google-password?