Millions of people have downloaded a malicious browser extension containing adware or malware – and have no idea. We look at the security risks.