Colluding browser extension attack on user privacy and its implication for web browsers