Does the extension save mnemonic in the browser? If yes, is it safe?
The Polkadot Extension doesn't store the Mnemonic words, see from the Polkadot Support Page:
Both the Polkadot browser extension and Polkadot-JS UI only show your mnemonic seed once: during the initial creation of your account. If you miss taking note of it, or if you misplaced your seed, there is no way to view it again at a later stage. While you can always restore your account from your JSON file, you won't be able to see your mnemonic seed again. For this reason, it is very important to save it in a safe place (preferably offline) at the time of account creation.
The only thing it stores is a JSON encrypted with a password. Decrypting it you only can get the KeyPair and with that be able to sign: shttps://polkadot.js.org/docs/keyring/start/basics/#keypair-types
See the article How to restore your account in the Polkadot extension for more info.
I suppose the Polkadot extension does not save the mnemonic phrase in the browser by default, but it does provide the option to save it in the browser's local storage, encrypted with the user's password. whether it is safe or not depends on the user's security practices, and the option to save the mnemonic phrase in the browser's local storage can be useful in some cases, but it increases the risk of the mnemonic phrase being compromised if the browser is hacked or the device is lost or stolen.