Research firm Halborn disclosed a critical vulnerability within the browser extensions of web3 wallets like MetaMask and Phantom.