To put it simply, no, extensions cannot steal your information by default. However, when you download an extension, it requests various permissions. Once you accept the terms, you may have given the extension access to sensitive information—including credentials.