Ask Hackers: Are Firefox extensions secure?

AFAIK they're not isolated, i.e. running with the same privileges as the rest of XUL code, including Firefox UI itself. In the realm of a browser, I can imagine quite evil XUL extensions.

I cannot tell anything about the level of isolation for XUL runtime itself though - i.e. how protected the rest of your computer is from XUL code.

It's the same as installing any piece of software. So yes, they could.

This is why I never save passwords : simply for the just in case possibility.