Chrome extension is packed to zip archive. After setup it is installed on folder and user can access to it. Also he can rewrite extension and even clone to new extension.
<
The premise seems to be simple. By default browser interprets HTML/Javascript, so are the chrome extensions which run along with the page.
One way is to obfuscate your javascript code , or rely on NPAPI compiled-binary plugins, or use NaCL
Obfuscating the code might no longer be a solution after Chrome forbade obfuscating extensions: https://stackoverflow.com/a/49509913