How Web Apps Can Turn Browser Extensions Into Backdoors