Deep down the certificate pinning rabbit hole of “Tor Browser Exposed” (seclists.org)

or for a Firefox user?

From what it looks like, basically full control of the browser by anyone that can manage to I personate the addons.mozilla.org. and that the fix wasn't expected or understood in the sept 4th nightly release. there's probably going to be a bigger investigation of this problem from what I'd expect because of that.