The service wouldn't give the browser elevated privileges. If you're worried about an update being compromised, then don't, since they're delivered over SSL and (I believe) are also signed separately.