When visiting a supported site Firefox shows a pop-up message asking if you want to install a WebApp (for instance facebook, pandora, etc). If you accept, the corresponding package is installed (for instance unity-webapps-facebookmessenger, unity-webapps-pandora-com, etc) which among other things involves copying files under folder /usr/share/unity-webapps/userscripts/ (no root password is requested during the process).
My question is: how all this is possible since Firefox is running without root privileges? Couldn't this lead to security issues? Thanks