An extension could contain anything from a keylogger to record everything you type in your browser to a file uploader that sends ALL of the files on your computer to a remote party. And as Bob noted, Norton and others will generally offer little protection since they are extensions, not applications, and protection in that field is still lacking.
The good news:
1.) The extensions are only a risk while your browser's open/running.
2.) The source code of the extensions are available for anyone to review, so experienced programmers often spot untrustworthy extensions and sound the alarm.
3.) You can always ask here and other reputable forums if you are in doubt about a particular extension.
Hope this helps,