Google kept featuring this Chrome extension for months after it turned malicious