> That's not true either. The malware would require privilege escalation to co-opt my browser. Does it? Sure it can't replace /usr/bin/firefox, but what's stop

> That's not true either. The malware would require privilege escalation to co-opt my browser. Does it? Sure it can't replace /usr/bin/firefox, but what's stopping the malware from writing a fake shortcut to ~/.local/share/applications/malwarefirefox.desktop and waiting until you click the fake shortcut? Or kill the running firefox and start the malware version? Or add some malware extension directly to ~/.mozilla/firefox/profiles? Or something else? Or are you assuming the malware is running in a sandbox like AppArmor?