Websites can steal browser data via extensions APIs