Benign add-ons can be weaponized with malicious updates after gaining user trust.