Three malicious VPN extensions on the Chrome Web Store infected 1.5 million devices before being removed by Google::undefined