[icebraining]

Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...

[mrob]

Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).