There are a lot of bytes moving around. I mean, I basically trust mozilla, but if they were a bad actor, it could easily be hidden steganographically.

And if your client is compromised then you're basically hosed in any secure application.

Network traffic could be encrypted, so you'd have to analyze the JavaScript.