Firefox accepts local certs over pinned ones by default as well (superfish affected it too). I believe there is an about:config setting that can be changed to

Firefox accepts local certs over pinned ones by default as well (superfish affected it too). I believe there is an about:config setting that can be changed to have it reject local certificates in the face of a pinned site, but if malware is putting certificates in Firefox's cert store, they can just as easily flip that setting as well.