Is the browser extension configuration owned by root? I thought that would be owned by your user. So the malware could modify that configuration.