<i>"Firefox forces you to download an executable and then manually run it, so a user would be conscious that he or she is installing a program."</i><p>Unfortunately not. I already encountered malware specifically targeted to Firefox that was fully automatic.<p>It used some Mozilla specific JS hooks to launch Acrobat plugin. This in turn loaded tiny infected PDF that exploited some Acrobat security hole which allowed to directly execute code on your machine.<p>It was enough to visit a compromised website, no further user action required. All was happening automatically, practically invisible to the user. I only noticed it because Acrobat plugin is a massive resource hog, so I managed to kill it in time before it could execute a payload.