The JSONView extension on Firefox was targeted a while ago. (2017?)

I only found out because Mozilla forced an uninstall with a warning and then I had to go down Bugzilla to find the impact (it leaked browser visit URLs).