Where the agency previously only had authority to snoop on either foreign powers or an "agent of a foreign power," it would have the authority to surveil anyone who knowingly helps others who conduct "international malicious cyber activity." That looser definition theoretically lets the NSA collect data on people who are only incidentally connected, rather than those directly involved.
There are other issues. This would offer guidance on reviving the sweeping "about" collection that scooped up American email en masse, and hints that the NSA could target whole facilities for surveillance, not just specific targets. And when the agency wants to read data caught by widescale surveillance, it would only have the option of seeking a warrant, rather a requirement.
There's no guarantee this will survive a House vote or the rest of the Congressional gauntlet, but there's clearly an attempt to rush the measure through the legislature and minimize chances for scrutiny. Both the Committee and the public had less than 2 days to see what it contained before the decision to move forward. And what little debate time there was ended up revolving around protections for "unmasking" the identities of Americans, not the broader privacy issues. The NSA could get significantly extended powers with little public discussion.