Since it's the more popular browser for non-tech people (i'd imagine firefox leans more towards tech/privacy-conscious people than 'normal' users), it's probably the first one targeted for auto-extension installation by malware.