Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no matter how securely you store it ?
If the user has a malicious browser extension, then there is nothing that a site owner can reasonably be expected to do to secure that user's information.
Properly using session and access tokens to identify a user after authentication remains the best practice, even when the user's machine is compromised. This OWASP Session Management Cheat Sheet gives a good overview of these best practices, and the OAuth standard is battle tested for most general-use identification purposes. Secure the token as securely as you can, and remember that you can't blindly trust the remote machines.