A web-based attack called clickjacking can get information from password manager browser extensions using auto-fill settings. Here’s how to protect yourself.