Go to PCMag.com

A doctoral candidate at Indiana University has discovered a vulnerability in many of the most popular Firefox extensions. The attack requires that other significant compromises exist on the network—specifically that the user's DNS server be compromised—and at that point Firefox can be exploited to run attack code in the context of the logged-on user.

Every Firefox extension has a URL hard-coded into it at which it checks for updates. Many check back on the https://addons.mozilla.org site from which add-ons are downloaded, but many, including many of the most popular, check on their own sites, often without the benefit of https.

Therefore, if the user's DNS server is compromised, the extension can be tricked into checking the wrong site—one spoofing the standard update address for the extension—for updates, and install them. Security mechanisms in Firefox for dealing with this situation, such as code signing, are weak.

The easiest answer would be for vendors to use SSL for updates, which you can expect to see starting with new updates. In the meantime, the researcher recommends uninstalling a long list of toolbars and extensions, including "Google Toolbar, Google Browser Sync, Yahoo Toolbar, Del.icio.us Extension, Facebook Toolbar, AOL Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, PhishTank SiteChecker and a number of others, mainly commercial extensions."

How could your DNS become compromised? It could happen on public wireless networks, through a compromise of your home router, or many other scenarios, though this is not a common mode of attack.