Security firm Avast has identified 28 malicious Google Chrome and Microsoft Edge extensions that have received 3 million downloads globally.