All password managers need access to the plaintext version of the password at some point... They need to put that into the login field. Chrome syncing across b

All password managers need access to the plaintext version of the password at some point... They need to put that into the login field. Chrome syncing across browsers does not mean they are being stored in plaintext. Your login is likely given you access to a key to decrypt them. Chrome does have an ability to encrypt the password store with a different password of your choosing. In this case syncing still happens, but each browser install requires you to enter in the second password to unlock the store. A malicious browser plugin does not need access to your password store to steal your password. Sooner or later you are going to log into a website and it will just steal it then.