They used to have its own toolbar that tracked which websites users visit.

After that, they've paid other browser add-ons to add their script and some websites voluntarily gave them their data by adding their tracker.

It says so right on the about page (warning: unusable on mobile): https://www.alexa.com/about