4 ms·
Malware can set that config option without consent.
by mastax 5y ago
Malware can set that config option without consent.
- throwaway2048 5y agoMalware can also install firefox developer's edition, or a modified firefox without consent.
- jsploit 5y agoIf malware has that level of access on your machine, chances are your browser is already fully compromised.
- noisem4ker 5y agoConfiguration and add-ons reside in %AppData%, or an orherwise user-writable profile directory. Compromising the executable, which lives under %ProgramFiles%, or an otherwise protected directory, takes administrator rights. Beyond this plausible inconvenience, however, Mozilla simply doesn't want regular users messing with unapproved add-ons. Just switch Firefox to Developer Edition for that. It's been very stable, in my experience.
- hda2 5y agoThen why wont they allow users to install their unsigned addons in %ProgramFiles%? I don't think protecting against a compromised %AppData% was their only goal.
- jsploit 5y agoThe Firefox profile directory also contains things like its file cache and trusted CA database, so you don't need to plant a malicious extension to achieve significant impact when you only have write access.