> the extension injects code into their site.

But it doesn't inject code into their site, right? The HTTP request is made to the server all the same, nothing modified via the browser, it's all code additive/correction in the extension?