Tavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html
(he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)
(he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)