~
My guess, they cannot if you encrypt the wallet? Or they can do it even with an encrypted wallet?
i don't think so, if sometime we tried to open our wallet, for example Myetherwallet, when we trying to open our wallet from the site, we must choose (usually) json file or private key, i think they can read the decrypt key from this site and send the code to owner from this extension, like keylogger but with another improvement for read the decrypt key directly from our browser
As soon as you've got malware on your PC, even your encrypted private-key is not really safe anymore.
At the latest as soon as you're using your wallet and enter your password, the attacker will be able to access your wallet.
And exactly that's why you should always use a hardware-wallet or sign your transactions offline.