A critical N-able Passportal browser extension flaw could let malicious sites steal entire password vaults, including live 2FA codes.