Two Chrome extensions were found eavesdropping on people's browsing, stealing login credentials and payment card information.