Yes, you can have web-content in a Firefox addon, but be very careful or else the web page (or anything that intercepts the web page) will have access to everything Firefox itself could do!
If you use an XUL iframe (or any iframe element or runnable data inserted from untrusted content in Chrome:// context), please read this article carefully: