Cyberhaven, a data loss prevention startup, has reported a malicious update in its Chrome extension, allegedly aimed at stealing passwords and session tokens.