If they've stolen your cookies, they can already login as you. The keylogger is already going to run in user space, as you.

You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.