Thanks. I've actually just noticed that Chrome seems to have a new option for extensions that lets me keep them enabled but without access to any site until I click on them. This means I can install an extension, browse NS normally, and give access to the extension only at the moment I need it. That makes the risk much smaller