How To Install Silently Malicious Extensions For Firefox

This report demonstrates a technique and accompanying C# tool that silently installs a malicious Firefox extension by adding approved records to a profile's extensions.sqlite, bypassing the browser's 3rd-party-install warning. The write-up explains how silently-installed extensions can stealthily steal credentials, exfiltrate URLs, and evade detection because extension activity appears as normal browser behavior; sample code and a demo are provided but the shipped extension has its harmful actions commented out.