Code signing is recent security feature added to Firefox, which Mozilla deemed necessary to prevent situations like these. This feature prevents the browser from installing unsigned add-ons that have not been tested (and signed/certificated) by Mozilla. This file contained options that disabled Firefox's built-in add-on signing feature. The user analyzed the add-on's source code and found that the extension was altering the browser's default settings by installing a new user.js configuration file.

Rogue add-on was altering Firefox security settings This past weekend, a user complained about the add-on exhibiting sneaky behavior, saying that his Avast antivirus blocked a download coming from a third-party website as soon as he installed the YouTube Unblocker add-on. It does so by using a collection of proxy servers to reroute YouTube content through countries in which the videos are whitelisted. YouTube Unblocker is a Firefox add-on that allows users to view YouTube videos blocked in their country.

Mozilla developers have taken steps to ban the popular YouTube Unblocker add-on after it was caught altering browser security settings and even installing a second add-on without the user's consent.

Firefox add on youtube video