A report says that three million people downloaded 28 extensions for Google Chrome or Microsoft Edge browsers that contain malicious code that could display unwanted ads or jeopardize security.