Popular browser extensions like ad blockers have been caught harvesting personal data of millions of consumers who use Chrome and Firefox — not only their browsing histories but also exposing tax returns, medical records, credit card information and other sensitive data in the public domain.

The exposed data via eight browser extensions also include vehicle identification, numbers of recently bought automobiles, along with the names and addresses of the buyers. Patient details, travel itineraries, Facebook Messenger attachments and Facebook photos, even private, are now available in the public domain.

Nacho Analytics, for example, promises to let people “see anyone’s analytics account” and to provide “real-time web analytics for any website”. The company charges $49 per month, per domain, to monitor any of the top 5,000 most widely-trafficked websites. The security expert has suggested users to delete all browser extensions they have installed in the past.