Firefox is just ridiculously insecure all around as a platform for extensions. Instead of developing a new least-privilege extension API like Chrome did, Mozil

Firefox is just ridiculously insecure all around as a platform for extensions. Instead of developing a new least-privilege extension API like Chrome did, Mozilla put in an App Store style review process on A.M.O. for real extensions and developed a new API just for lame themes. They have code signing baked in but don't even use it for their own code, so an annoying 'unsigned' warning is the expected default. Even with all that, the extensions themselves have highly-exploitable vulnerabilities: http://lwn.net/Articles/348769/ http://lwn.net/Articles/348769/ It's probably the best means to get remote code execution on Linux, especially since extensions can bundle native NPAPI plugins.