AFAIK they're not isolated, i.e. running with the same privileges as the rest of XUL code, including Firefox UI itself. In the realm of a browser, I can imagine

AFAIK they're not isolated, i.e. running with the same privileges as the rest of XUL code, including Firefox UI itself. In the realm of a browser, I can imagine quite evil XUL extensions. I cannot tell anything about the level of isolation for XUL runtime itself though - i.e. how protected the rest of your computer is from XUL code.