For example, Lastpass recently had an exploit in their extension: https://news.ycombinator.com/item?id=12171547