6

I would like to install the Dictionary Pop-Up addon for Firefox. I usually don't install any addons, but this one looks especially tempting.

I could not find any information on the Mozilla page, whether or not this addon is authorized/approved/reviewed.

What are the chances that an addons mozilla.org on is malicious? And, if it was malicious, how are usually malicious addons discovered? I mean, if 30.000 people already downloaded it, is it less likely that it is a malware? Would it have been discovered already?

I have used this specific addon as an example, but I am interested in this problem in general.

3 Answers 3

3

In April of 2017 and earlier, the FAQ provided a reasonably strong guarantee of safety:

Are add-ons safe to install?

Unless clearly marked otherwise, add-ons available from this gallery have been checked and approved by Mozilla's team of editors and are safe to install. We recommend that you only install approved add-ons.

Between then and June of 2017, that guarantee was weakened:

Use caution when installing add-ons, as they may harm your computer or violate your privacy. Add-ons available from this site may be subject to review by Mozilla's team of reviewers, and user feedback is closely monitored, so they should generally be safe to install.

And sometime around July of 2018, the entire FAQ, including any mention of addon safety, was removed.

9

The accepted answer is out of date.

As of October 28, 2017 Firefox FAQ states a different view (note the "may"):

Are add-ons safe to install?

Use caution when installing add-ons, as they could harm your computer or violate your privacy. Add-ons available from this site may be subject to review by Mozilla's team of reviewers, and user feedback is closely monitored, so they should generally be safe to install.

1

There have been a few incidences of add-ons in the Experimental category being found to have malware. I seem to remember the Thai dictionary addon being found malicious even after approval, but interestingly I cannot find any supporting links at the moment.

From the Mozilla blog:

Two experimental add-ons, Version 4.0 of Sothink Web Video Downloader and all versions of Master Filer were found to contain Trojan code aimed at Windows users. Version 4.0 of Sothink Web Video Downloader contained Win32.LdPinch.gen, and Master Filer contained Win32.Bifrose.32.Bifrose Trojan. Both add-ons have been disabled on AMO.

1
  • 1. The blog posts you cite are from 5+ years ago. 2. One of the addons were found to be safe later, the alarm was a false positive (blog.mozilla.org/addons/2010/02/09/…). 3. The reports were about " experimental" addons. That are addons that have not been reviewed yet. These addons can only be installed after confirming the warning. So, AMO is quite safe. Especially when compared to other extension galleries.
    – Rob W
    Aug 29, 2015 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .