Firefox accepts local certs over pinned ones by default as well (superfish affected it too).<p>I believe there is an about:config setting that can be changed to have it reject local certificates in the face of a pinned site, but if malware is putting certificates in Firefox&#x27;s cert store, they can just as easily flip that setting as well.