Among Chrome extension permissions, cookies sits in the critical tier at 93 out of 100, and it is the one most likely to appear in an extension that seems mundane.
The reason it ranks so high is that cookies are authenticated session state. An extension with cookie access for a host can read the token that proves you are logged in, which is functionally equivalent to being logged in as you, without needing your password and without triggering anything a login alert would catch.
It keeps company with webRequestBlocking at 98, nativeMessaging at 96, and fileSystem and desktopCapture at 95. Those are recognisably powerful. Cookie access reads as administrative by comparison, which is exactly why it is worth flagging.
The mitigation is narrow scoping. Cookie permission restricted to a single host the extension genuinely integrates with is a normal requirement. Cookie permission paired with broad host access is a different proposition, and the combination is the thing to look for rather than either part alone.
An extension permission breakdown is at zovo.one.