aNopBxEjtX

that doesn't let you launch processes, it lets you interact with running ones. even if the chrome extensions could launch new processes, they run inside Untrusted integrity level on Windows, you can verify this at chrome:sandbox and checking the Chrome task manager (shift+esc). You cannot interact with processes above your own integrity level nor launch processes with an integrity level higher than your current.

the site is an advertising redirect and these same attackers (or at least users of the same IP ranges) use leaked credentials to login to Microsoft/Outlook accounts using SMTP

I sense sarcasm, but in case my sense is off, there is a webapp which allows you to log into your apple account and webapps are known to sometimes have security issues.

they can't