A browser extension attack that went undetected for years has affected millions of Google Chrome and Microsoft Edge users.