The issue allows attackers to modify add-ons before installation by leveraging the time window during which the app tmp directory is used, due to world-writable and world-readable permissions for the app tmp installation directory in the local filesystem.