Chrome Extension Security

A page can inventory your extensions with an image tag and a list of store IDs

Web-accessible extension assets sit at fixed URLs built from public IDs, so onload versus onerror answers installed-or-not without asking anyone. The only party who can close that door is the extension's author.