What happens when a Chrome extension with 2m+ users changes hands, raises red flags, doesn't document updates? Let's find out