The extensions are already running code in the same process, so if you don't trust an installed extension you've already lost.