1

Some of the applications I installed or Some websites I visited, added unwanted addons to Firefox. These addons don't even have a "Remove" button in "about:addons" page. What if they are malicious or what if they make my browser vulnerable to attacks.
Of course Firefox informs you about the install and asks for your permission but, you know, that's not enough specially when your careless sister uses your computer! This is a serious security issue with Firefox.
So how can I force Firefox to automatically reject addon installations from everywhere but "addons.mozilla.org" website (a block-by-default policy)?
Google Chrome seems to have this feature by default. I don't see it in Firefox's settings. Am I missing something?! I'm using Windows if that matters. thanks in advance.

  • 1
    FYI, this is largely a non-issue with modern versions of Firefox since extensions must be signed by AMO to be installed. Side-loaded extensions must have been signed by Mozilla, even if they are not publicly listed on AMO. – Bob Jun 12 '17 at 14:38
  • Though, more practically, attempting to 'block' such side-loading is also fairly pointless security-wise: they are 'installed' by placing a file in the profile directory (or even the system-wide install directory, for the unremovable ones). This means whatever installed them has already run arbitrary code on your computer, and if you consider such programs to be an issue then there's bigger problems than just a browser extension. – Bob Jun 12 '17 at 14:42
  • @Bob I just finished reading the link you provided. now that's a relief! – M_M Jun 12 '17 at 14:54
  • @Bob about your second comment: you do have a point there, but... controlling windows apps is much easier than browser addons for a normal user like me. (useing an anti-exe app to stop unwanted installations, checking VirusTotal, sandboxing, only installing digitally-signed apps and monitoring them using "process hacker" and a firewall) but I can't do these with addons. it would be great that firefox simply ignore those files and codes that are not from a specific source, no matter what. simple, if the code doesnt run by default inside firefox, it doesn't create vulnerability. – M_M Jun 12 '17 at 15:59
0

It is currently not very easy to disable add-on installation1, and likely harder still to attempt to whitelist specific sites. There is a reason for this: at its core, a Firefox add-on is a package that isn't really tied to the site you download it from. This also means any program that can write to your computer can 'install' an add-on by placing this package in the correct location2, as you've noticed.

However, the threat of malicious add-ons has been greatly reduced in the last year or so, since the current release versions of Firefox require extensions to be signed. This means only extensions reviewed and signed by Mozilla can be installed. Most of the time, this means extensions listed on the Mozilla website3. Therefore, you most likely do not need to go to the trouble of trying to whitelist a download source.


1 In a kiosk environment, the easy way around this is to use temporary profiles.

2 Not usually considered a security risk, since any program that can write to your disk can do far, far more than merely install an add-on to your browser.

3 It is possible to get extensions signed by Mozilla without listing them, but they still do go through some review. Practically, this means extensions can be installed from non-AMO sources, but you can treat them as having had more or less the same scrutiny.

  • Thanks a lot for your kind answer sir. Haven't thought of a temporary profile! Great workaround suggestion. accepting your answer. – M_M Jun 13 '17 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.