Third-party developers don’t always build extensions with security best practices in mind. Now Google is taking steps to better protect user data.