Browser extensions downloaded 33 million times have been stealing information from their users. When will it end?