Bug-2011234: remove the ability to dynamically execute code in `moz-extension:` documents by rebloor · Pull Request #43108 · mdn/content

rebloor · 2026-02-12T18:05:58Z

Description

Addresses the dev-docs-needed requirements of Bug 2011234 Extensions can dynamically execute code in their moz-extension: documents with tabs/scripting.executeScript by:

the addition of a release note
removal of references to extensions automatically getting host permissions for their origin from the documentation for the permissions and host_permissions manifest keys.
removal information about executing scripts in an extension's origin from tab.executeScript.

Although this change also applies to tabs.insertCSS, tabs.removeCSS, scripting.executeScript, scripting.insertCSS, and scripting.removeCSS, no explicit reference to the feature was made in those methods. No documentation changes were made, as the default expectation is that a web page can fetch() in its own URLs, which also applies to extension documents.

…xtension:` documents

github-actions · 2026-02-12T18:07:40Z

Preview URLs (7 pages)

External URLs (8)

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/executeScript
Title: tabs.executeScript()

https://firefox-source-docs.mozilla.org/devtools-user/web_console/index.html (1 time) (Note! This may be a new URL 👀)
https://github.com/mozilla/webextension-polyfill (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions
Title: host_permissions

https://bugzil.la/1893232 (1 time)
https://extensionworkshop.com/documentation/develop/request-the-right-permissions/ (1 time)
https://extensionworkshop.com/documentation/develop/test-permission-requests/ (1 time)
https://support.mozilla.org/en-US/kb/extensions-button (1 time)

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions
Title: permissions

https://bugzil.la/1446956 (1 time) (Note! This may be a new URL 👀)
https://extensionworkshop.com/documentation/develop/request-the-right-permissions/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2026-02-27 18:21:56)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Rob--W · 2026-02-13T00:29:22Z

+You must have the permission for the page's URL either explicitly, as a [host permission](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#host_permissions), or using the [activeTab permission](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#activetab_permission). Note that some special pages do not allow this permission, including reader view, view-source, and PDF viewer pages.

-You can also inject code into pages packaged with your own extension:
+You _cannot_ inject code into:


Please remove the enumeration and just state that content scripts cannot be run in extension documents. If an extension wants to dynamically run code, they could register a runtime.onMessage listener and send a message there instead. Please linkify the runtime.onMessage API, which itself also provides pointers to relevant APIs: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage

Co-authored-by: Rob Wu <rob@robwu.nl>

Rob--W

Please read the review feedback and merge after applying it. If in doubt, please ping me for another review.

We now also link to runtime.onMessage, but "the example use cases" do not include the specific case here. Please add a bullet point listing this use case:
"in an extension document in a tab to listen for messages from the background script or anywhere else"

This use case is already pointed to in tabs.sendMessage as "extension pages/iframes that belong to the extension and are running in the specified tab."

Rob--W · 2026-02-23T15:56:49Z

+You _cannot_ inject code into any of the browser's built-in pages, such as `about:debugging`, or `about:addons`, or the page that opens when you open a new empty tab.



Suggested change

You _cannot_ inject code into any of the browser's built-in pages, such as `about:debugging`, or `about:addons`, or the page that opens when you open a new empty tab.

The last part of the previous paragraph already explains that certain pages cannot be scripted, so I am suggesting to drop this (repetitive) part.

Rob--W · 2026-02-23T16:21:13Z


 <!-- ### Removals -->

+The ability of extensions to dynamically execute code in their `moz-extension:` documents with {{WebExtAPIRef("tabs.executeScript")}}, {{WebExtAPIRef("tabs.insertCSS")}}, {{WebExtAPIRef("tabs.removeCSS")}}, {{WebExtAPIRef("scripting.executeScript")}}, {{WebExtAPIRef("scripting.insertCSS")}}, and {{WebExtAPIRef("scripting.removeCSS")}} is deprecated. The feature is no longer available in Firefox Nightly, and the beta and release versions of Firefox provide a warning in the tab's console. This restriction will apply to all versions of Firefox 152 and later. ({{bug(2011234)}})


I wonder whether we should explicitly recommend or link to alternatives from here, in case it is not obvious. E.g. referring to runtime.onMessage as an alternative for most cases.

Co-authored-by: Rob Wu <rob@robwu.nl>

rebloor · 2026-02-24T22:50:49Z

@Rob--W unfortunately, I can't figure out what your intention was with the comment about "Please add a bullet point listing this use case". Can you clarify? The other changes have been made. Note, I've modified the wording in the "Extensions cannot run content scripts in extension documents." paragraph, as I wasn't sure it was entirely clear. I've also added this paragraph to scripting/executeScript (was this what your comment about the bullet point referred to?)

Rob--W

@Rob--W unfortunately, I can't figure out what your intention was with the comment about "Please add a bullet point listing this use case". Can you clarify?

The onMessage documentation (https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage) has a bullet list of use cases. I am requesting to explicitly list the use case that we are now prominently mentioning (as an alternative to the deprecated executeScript usage).

I've also added this paragraph to scripting/executeScript (was this what your comment about the bullet point referred to?)

That is not what I was referring to, but as tabs.executeScript and scripting.executeScript have the same capabilities, it makes sense to include the same information there, so I am okay with keeping the same text there.

Rob--W · 2026-02-26T00:39:48Z

 Using methods (1) and (2), you can only load scripts into pages whose URLs can be represented using a [match pattern](/en-US/docs/Mozilla/Add-ons/WebExtensions/Match_patterns).

-Using method (3), you can also load scripts into pages packaged with your extension, but you can't load scripts into privileged browser pages (like `about:debugging` or `about:addons`).
+Using method (3), you cannot load scripts into pages packaged with your extension, privileged browser UI pages (such as `about:debugging`, `about:addons`, reader view, view-source, or the PDF viewer).


This text now contains the correction I suggested before, but the other part of my feedback below the suggested text has not been applied. Could you read my previous review at #43108 (comment) and apply the full suggestion?

rebloor · 2026-02-26T22:39:52Z

@Rob--W sorry for the slow uptake on your feedback. Hopefully, everything is done now.

Rob--W

Approved with the changes applied. Please check for typos before merging.

Rob--W · 2026-02-27T00:37:33Z

+
 ### Limitations

 Whole tabs or frames may be loaded using [`data:` URI](/en-US/docs/Web/URI/Reference/Schemes/data), {{DOMxRef("URL.createObjectURL_static", "Blob")}} objects, and other similar techniques. Support of content scripts injection into such special documents varies across browsers, see the Firefox [bug #1411641 comment 41](https://bugzil.la/1411641#c41) for some details.


Deleted the whole section because it is obsolete. I merged the content with the new section.

Suggested change

### Limitations

Whole tabs or frames may be loaded using [`data:` URI](/en-US/docs/Web/URI/Reference/Schemes/data), {{DOMxRef("URL.createObjectURL_static", "Blob")}} objects, and other similar techniques. Support of content scripts injection into such special documents varies across browsers, see the Firefox [bug #1411641 comment 41](https://bugzil.la/1411641#c41) for some details.

Co-authored-by: Rob Wu <rob@robwu.nl>

github-actions · 2026-02-27T18:07:29Z

+
+If an extension wants to run code in an extension page dynamically, it can include a script in the page. This script contains the code to run and registers a {{WebExtAPIRef("runtime.onMessage")}} listener that implements a way to execute the code. The extension can then send a message to the listener to trigger the code's execution.
+
+### Limitations


[markdownlint] _{reported by reviewdog 🐶}
error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Limitations"]

@Rob--W

…xtension:` documents (mdn#43108) * Bug-2011234: remove the ability to dynamically execute code in `moz-extension:` documents * Apply suggestions from linter Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Apply suggestions from review Co-authored-by: Rob Wu <rob@robwu.nl> * Apply suggestions from review Co-authored-by: Rob Wu <rob@robwu.nl> * Apply suggestion from @Rob--W Co-authored-by: Rob Wu <rob@robwu.nl> * Apply suggestion from @Rob--W Co-authored-by: Rob Wu <rob@robwu.nl> * Further clarifications of dynamic code execution in extension documents * Apply suggestions from review Co-authored-by: Rob Wu <rob@robwu.nl> * Further feedback related changes * typo * Further feedback changes * Apply suggestions from @Rob--W review Co-authored-by: Rob Wu <rob@robwu.nl> * Minor corrections * Reapply deletion --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Rob Wu <rob@robwu.nl>

Bug-2011234: remove the ability to dynamically execute code in `moz-e…

210e1d5

…xtension:` documents

rebloor self-assigned this Feb 12, 2026

rebloor requested review from a team as code owners February 12, 2026 18:05

rebloor requested review from Rob--W and removed request for a team February 12, 2026 18:06

rebloor added the Content:WebExt WebExtensions docs label Feb 12, 2026

rebloor requested review from dipikabh and removed request for a team February 12, 2026 18:06

github-actions Bot added Content:Firefox Content in the Mozilla/Firefox subtree size/m [PR only] 51-500 LoC changed labels Feb 12, 2026

github-actions Bot reviewed Feb 12, 2026

View reviewed changes

Comment thread files/en-us/mozilla/add-ons/webextensions/api/tabs/executescript/index.md Outdated

Comment thread files/en-us/mozilla/add-ons/webextensions/manifest.json/permissions/index.md Outdated

Apply suggestions from linter

3e47dff

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Rob--W requested changes Feb 13, 2026

View reviewed changes

rebloor and others added 5 commits February 14, 2026 04:20

Apply suggestions from review

1f4579b

Co-authored-by: Rob Wu <rob@robwu.nl>

Apply suggestions from review

7399ffa

Co-authored-by: Rob Wu <rob@robwu.nl>

Apply suggestion from @Rob--W

42c8684

Co-authored-by: Rob Wu <rob@robwu.nl>

Apply suggestion from @Rob--W

f4ea9d1

Co-authored-by: Rob Wu <rob@robwu.nl>

Further clarifications of dynamic code execution in extension documents

b86a22a

rebloor requested a review from Rob--W February 13, 2026 17:56

Rob--W approved these changes Feb 23, 2026

View reviewed changes

rebloor and others added 2 commits February 25, 2026 05:29

Apply suggestions from review

d602e82

Co-authored-by: Rob Wu <rob@robwu.nl>

Further feedback related changes

74d57bd

rebloor requested a review from Rob--W February 24, 2026 22:51

typo

bf0bca9

Rob--W reviewed Feb 26, 2026

View reviewed changes

Further feedback changes

5499f16

rebloor requested a review from Rob--W February 26, 2026 22:39

Rob--W approved these changes Feb 27, 2026

View reviewed changes

Apply suggestions from @Rob--W review

d921cec

Co-authored-by: Rob Wu <rob@robwu.nl>

github-actions Bot reviewed Feb 27, 2026

View reviewed changes

rebloor added 2 commits February 28, 2026 07:18

Minor corrections

aa98b41

Reapply deletion

d6c4e3a

rebloor merged commit 2869180 into mdn:main Mar 1, 2026
8 checks passed

rebloor deleted the Bug-2011234-remove-ability-to-dynamically-execute-code-in-their-moz-extension-documents-with-tabs-and-scripting.executeScript branch March 1, 2026 15:52

		You _cannot_ inject code into any of the browser's built-in pages, such as `about:debugging`, or `about:addons`, or the page that opens when you open a new empty tab.


		<!-- ### Removals -->

		The ability of extensions to dynamically execute code in their `moz-extension:` documents with {{WebExtAPIRef("tabs.executeScript")}}, {{WebExtAPIRef("tabs.insertCSS")}}, {{WebExtAPIRef("tabs.removeCSS")}}, {{WebExtAPIRef("scripting.executeScript")}}, {{WebExtAPIRef("scripting.insertCSS")}}, and {{WebExtAPIRef("scripting.removeCSS")}} is deprecated. The feature is no longer available in Firefox Nightly, and the beta and release versions of Firefox provide a warning in the tab's console. This restriction will apply to all versions of Firefox 152 and later. ({{bug(2011234)}})


		### Limitations

		Whole tabs or frames may be loaded using [`data:` URI](/en-US/docs/Web/URI/Reference/Schemes/data), {{DOMxRef("URL.createObjectURL_static", "Blob")}} objects, and other similar techniques. Support of content scripts injection into such special documents varies across browsers, see the Firefox [bug #1411641 comment 41](https://bugzil.la/1411641#c41) for some details.


		If an extension wants to run code in an extension page dynamically, it can include a script in the page. This script contains the code to run and registers a {{WebExtAPIRef("runtime.onMessage")}} listener that implements a way to execute the code. The extension can then send a message to the listener to trigger the code's execution.

		### Limitations

Conversation

rebloor commented Feb 12, 2026

Description

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Rob--W Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Rob--W left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Rob--W Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Rob--W Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

rebloor commented Feb 24, 2026

Uh oh!

Rob--W left a comment

Choose a reason for hiding this comment

Uh oh!

Rob--W Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

rebloor commented Feb 26, 2026

Uh oh!

Rob--W left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Rob--W Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Feb 12, 2026 •

edited

Loading