All Chrome extensions can execute remote code in their own context:
Included in the bug report is a proof-of-concept web extension by gorhill, author of uBlock Origin.
Gorhill's proof-of-concept extension code is still up: https://gist.github.com/gorhill/b0316e35d4e7e4a44df39e8b7fa5ac20. His tweets about it though have been deleted.
And now the Gist has been removed. But it’s available on Archive.is: https://archive.is/hi5o1
The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!