A malicious Firefox add-on can hijack Google sessions and silently change passwords, putting users’ accounts at risk.