The extension injects the Zilliqa web3 API into every website's javascript context, so that dapps can read from the blockchain.
ZilPay also lets the user create and manage their own identities (via private keys, local client wallet and hardware wallets like Ledger), so when a Dapp wants to perform a transaction and write to the blockchain, the user gets a secure interface to review the transaction, before approving or rejecting it.
Because it adds functionality to the normal browser context, ZilPay requires the permission to read and write to any webpage. You can always "view the source" of ZilPay the way you do any Chrome extension, or view the source code on Github:
https://github.com/zilpay/zil-pay
ZilPay is a browser wallet for blockchain Zilliqa. Developers can integrate ZilPay into their website to create Decentralised Apps.
It allows developers to integrate smart contract calls on their website, in turn enabling the use of Dapps from within the browser. It also functions as a standard Zilliqa wallet for anybody wanting to broadcast and receive transactions on the network.