Browser extensions put 4M users at risk of cookie exposure