When software needs to use SSL/TLS, it commonly wants to use a list of Certificate Authorities. There may be software that simply always warns for every unknown certificate, but like you said, Firefox and Chrome have a list of CAs.
Where they get this list depends on the software. You can google this, you know.
- Mozilla maintains an own list of CAs (for Firefox, Thunderbird, etc.)
- Chrome uses the CA list from the operating system, or at least on Windows I read.
- Opera maintains an own list of CAs it seems.
- Safari uses the OS's list (Apple's on OS X and Microsoft's on Windows).
Then about your question regarding how this list is obtained: You are right, if the download was not verified to be secure (in a secure way), then all communications from thereon are inherently insecure. When you are downloading a Linux distribution and I replace your download with one that has an altered CA list, then yes, I could read all your HTTPS communications. It's probably much easier to just install malware though.
Note that a checksum alone is not the ultimate solution: the checksum must be obtained over a secure connection (e.g. https), or else that too can be altered.
It's funny: if you need to obtain the checksum over https, where did your current browser (or OS) get a CA list? Somewhere you always have to trust someone or something (such as the shop you bought Windows from), besides the trust that you put in CAs.
