It seems like the headline buries the lede here.

The problem is passwords being exposed in plain text. I already assume that my browser extensions can see everything I do, which is why I only use a couple of open source extensions with solid reputations.

It literally grabs it!