NoScript and other popular Firefox add-ons open millions to new attack (arstechnica.com)

... once you've downloaded a trojaned extension.

This attack is cross-extension. So you can't drive by or anything.