Firefox addons are opening millions of users to malware attacks