Chrome extension spyware disguised as a free VPN service highlights security risks after it captured private browsing data from trusted sites.