Ask Hackers: Are Firefox extensions secure?

[ahold]

Could Firefox extensions access my passwords stored in Firefox? Are you using extensions working with your passwords ... to check your new mail by example?

[tx]

AFAIK they're not isolated, i.e. running with the same privileges as the rest of XUL code, including Firefox UI itself. In the realm of a browser, I can imagine quite evil XUL extensions.

I cannot tell anything about the level of isolation for XUL runtime itself though - i.e. how protected the rest of your computer is from XUL code.

[almost]

It's the same as installing any piece of software. So yes, they could.

[vincent404]

This is why I never save passwords : simply for the just in case possibility.