Chrome extensions, and just like other browsers, appear to often get quite some extensive access to your browser data. In fact, most extensions I've installed require access to:


Your data on all websites
Your tabs and browsing activity


And this got me wondering what that implies, exactly. 

Let's say somebody writes an evil extension, calls it "I-KNOW-EVERYTHING-YOU-DO, and a RSS Reader" (he's evil, but also honest). I really like to have a RSS reader, so I install this. I see this big warning about the extension requiring access to all of my data, but then again, so does every other extension, so I gladly grant this access. 

Thinking worse-case scenario, what can this extension do? Could it:


Send a list of all the websites I visit to the maker? 
Capture data I input into forms? (like my personal data, passwords, etc.)
See how long I have been on a website, and which pages I have visited? 
Access cookies? 
Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)
Do anything worse? 




  Send a list of all the websites I visit to the maker?


Yes

  Capture data I input into forms? (like my personal data, passwords, etc.)


Yes

  See how long I have been on a website, and which pages I have visited? 


Yes

  Access cookies?


Updated, See the following comment from Bryan Field for this one.


  Bryan Field: Great answer, except for number 4. Cookies without the httponly flag can be accessed for sure, beyond that I don't know. I would add that it is likely that the extension could manually call, for example your Gmail page and get all your emails, even if you do not have Gmail open during the time the extension is opened. You need only to be logged in and it can call those pages. So even if the httponly cookies can not be directly viewed (number 4), it doesn't really matter, because the cookies can still be indirectly and effectively used


  Access other files on my computer? (I guess not, given the Sandbox environment, but I'm still wondering)


No – like you say the sandbox will prevent that.

  Do anything worse?


Read (and send) data on all the pages you visit.


Some more details on why this is often needed, but not always is discussed in this question Why do Chrome extensions need access to 'all my data' and 'browsing activity'?
