executeScript \/ registerContentScript in moz-extension documents<\/b><\/h2>\n
Deprecated: Firefox 149\u00a0 Removed: Firefox 152<\/strong><\/p>\n Starting in Firefox Nightly 149 and scheduled for Firefox 152, the scripting and tabs injection APIs no longer inject into moz-extension:\/\/<\/span>documents. This change brings the API in line with broader efforts to discourage string-based code execution in extension contexts, alongside the default CSP that restricts script-src<\/span> to extension URLs and the removal of remote source allowlisting in MV3 (bug 1581608<\/a>).<\/p>\n Firefox emits a warning when this restriction is met, so you are aware of and can address any use of this process in your extensions. This is an example of the warning message:<\/p>\n Content Script execution in moz-extension document has been deprecated and it has been blocked<\/em><\/p><\/blockquote>\n To work around this change, <\/b>\u00a0you can:<\/p>\n Target<\/b>: Firefox 152<\/p>\n Extensions requesting file:\/\/*\/<\/span> or <all_urls><\/span> currently trigger the \u201cAccess your data for all websites” permission message, and when granted, can run content scripts in file:-URLs. From Firefox 152, file access in extensions requires an opt-in for all extensions, including those already installed (bug 2034168<\/a>).<\/p>\n Removed<\/b>: Firefox 152<\/p>\n Firefox has been automatically applying a greyscale and brightness CSS filter to pageAction<\/span><\/span> (address bar button) SVG icons when a dark theme is active. This was intended to improve contrast, but it actually reduced contrast for multi-color icons and caused poor visibility for some extensions, such as Firefox Multi-Account Containers.<\/p>\n For icons that adapt to light and dark color schemes, you can now use @media (prefers-color-scheme: dark<\/span>) in the SVG icon, or the MV3 action<\/span> manifest key, and specify theme_icons<\/span><\/span><\/span>.<\/p>\n Here is an example of how to use a `prefers-color-scheme` media query in a pageAction SVG icon to control how the icon adapts to dark mode:<\/p>\n manifest.json<\/b><\/p>\n icons\/icon.svg<\/b><\/p>\n Use of prefers-color-scheme<\/span> media queries is also allowed in MV2 browserAction<\/span><\/span> and MV3 action SVG icons as an alternative to the theme_icons<\/span> manifest properties.<\/p>\n There are additional examples at the Mozilla Developer Network<\/a> on how to test your extension pageAction icon with and without the implicit CSS filter.<\/p>\n Now to the new stuff. Here, you get the ability to use popups without user activation, initial support for the new tab split view feature, and WebAuthn RP ID assertion.<\/p>\n Available<\/b>: Firefox 149 Desktop<\/p>\n action.openPopup()<\/a> and browserAction.openPopup()<\/a> no longer require a user gesture on Firefox Desktop. You can open your extension’s popup programmatically, e.g., in response to a native-messaging event, an alarm, or a background-script condition.<\/p>\n This change is part of the ongoing cross-browser alignment work in the WebExtensions Community Group<\/a> to harmonize popup behavior across engines.<\/p>\n Example<\/p>\n Before (Firefox < 149)<\/b>: must hang off a user gesture, e.g., a context menu click:<\/p>\n <\/p>\n After (Firefox \u2265 149)<\/b> \u2014 same intent, no user gesture needed, fires from a timer:<\/p>\n It\u2019s the same call with the same result, but only the trigger changes from a user-action handler to any background event.<\/p>\n It\u2019s the same call with the same result, but only the trigger changes from a user-action handler to any background event.<\/p>\n Available<\/b>: Firefox 149<\/p>\n Firefox 149 introduces a new read-only <\/b>splitViewId<\/b><\/span> property<\/b> on the tabs.Tab<\/a> object to expose Firefox’s new split view<\/a> feature (where two tabs are displayed side-by-side in one window). Split views are treated as one unit, and Web Extensions treat them the same way.<\/p>\n In Firefox 150, extensions can swap tabs within a split view. This update also resolves a confusing issue where using the user interface to reverse tab order incorrectly reports the tabs.onMoved<\/span> event with inaccurate values. Additionally, Firefox introduces unsplitting behavior for web extensions: when tabs.move()<\/a> is called with split-view<\/span> tabs positioned separately (non-adjacently) in the array. Now, after the call, Firefox removes the split view rather than keeping the tabs locked together.<\/p>\n Here is an example of using the new splitViewId<\/span> property.<\/p>\n <\/p>\n Firefox 151 enables extensions to move split views in tab groups. More improvements are coming, such as the ability to create split views from extensions (bug 2016928<\/a>).<\/p>\n <\/p>\n Available<\/b>: Firefox 150<\/p>\n Previously, web extensions couldn’t use WebAuthn credentials registered on their company’s website or mobile apps. When extensions tried to set a custom Relying Party ID (RP ID) in navigator.credentials.create()<\/span> or navigator.credentials.get()<\/span>, Firefox rejected it with “SecurityError: The operation is insecure.”<\/p>\n With Firefox 150, Extensions can now assert a <\/b>WebAuthn RP ID<\/b><\/a> for any domain they have host permissions for<\/b><\/p>\n when calling navigator.credentials.create()<\/span> or navigator.credentials.get()<\/span>. This applies to both the publicKey.rp.id<\/span> field during credential creation and the publicKey.rpId<\/span> field during authentication.<\/p>\n A critical detail for server-side validation:<\/b> When relying party servers validate credentials created by extensions, they must account for different origin formats across browsers<\/a>. In Chrome, the origin follows the pattern chrome-extension:\/\/extensionid<\/span>, which matches the extension’s location.origin<\/span>. Firefox 150 introduces a new stable origin format: moz-extension:\/\/hash<\/span>, where the hash is a 64-character SHA-256 representation of the extension ID (using characters a-p to represent hex values). Importantly, this hash-based origin is the same all users, unlike Firefox’s existing UUID-based moz-extension:\/\/<\/span> URLs used for extension documents.<\/p>\n To extract the origin from a credential for validation:<\/p>\n For more details, see Use Web Authn API in web extensions<\/a> on MDN.<\/p>\n You can always find detailed information about WebExtensions API and Add-ons updates in the MDN release notes<\/a>, e.g., for Firefox 149<\/a> and Firefox 150<\/a>.<\/p>\n For any help or questions navigating any changes, don\u2019t hesitate to post your topic on the Add-ons Discourse<\/a>.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":"![\"\"](\"https:\/\/blog.mozilla.org\/addons\/files\/2026\/04\/Screenshot-2026-04-14-092137-580x69.png\")
<\/a><\/p>\n\n
File access becomes opt-in<\/b><\/h2>\n
<\/h2>\n
pageAction SVG icon CSS filter (automatic color scheme)<\/b><\/h2>\n
\"page_action\": {\r\n \"default_icon\": \"icons\/icon.svg\"\r\n}<\/pre>\n<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 16 16\" width=\"16\" height=\"16\">\r\n <style>\r\n :root { color: black; }\r\n @media (prefers-color-scheme: dark) { :root { color: white; } }\r\n <\/style>\r\n <path fill=\"currentColor\" d=\"M2 2h12v12H2z\"\/>\r\n<\/svg><\/pre>\n
\nNew APIs & Capabilities<\/b><\/h2>\n
openPopup without user activation (Firefox Desktop)<\/b><\/h2>\n
browser.menus.create({\r\n id: \"nudge\",\r\n title: \"Open popup\",\r\n contexts: [\"all\"],\r\n});\r\n\r\nbrowser.menus.onClicked.addListener((info) => {\r\n if (info.menuItemId === \"nudge\") {\r\n browser.action.openPopup(); \/\/ user clicked the menu \u2192 allowed\r\n }\r\n});<\/pre>\nbrowser.alarms.create(\"nudge\", { delayInMinutes: 1 });\r\n\r\nbrowser.alarms.onAlarm.addListener((alarm) => {\r\n if (alarm.name === \"nudge\") {\r\n browser.action.openPopup(); \/\/ works without a click\r\n }\r\n});<\/pre>\n<\/h2>\n
splitViewId in the tabs API<\/b><\/h2>\n
\/\/ Log whenever a tab joins or leaves a split view.\r\nbrowser.tabs.onUpdated.addListener((tabId, changeInfo) => {\r\n if (!(\"splitViewId\" in changeInfo)) return;\r\n\r\n if (changeInfo.splitViewId === browser.tabs.SPLIT_VIEW_ID_NONE) {\r\n console.log(`Tab ${tabId} left its split view`);\r\n } else {\r\n console.log(`Tab ${tabId} joined split view ${changeInfo.splitViewId}`);\r\n }\r\n});\r\n\/\/ Firefox desktop also supports a filter to limite onUpdated events:\r\n\/\/ }, { properties: [\"splitViewId\"] });<\/pre>\nWebAuthn RP ID assertion<\/b><\/h2>\n
let clientData = JSON.parse(new TextDecoder().decode(\r\n publicKeyCredential.response.clientDataJSON\r\n));\r\nconsole.log(clientData.origin);<\/pre>\n
Summary<\/b><\/h2>\n
\n\n
\n Change<\/b><\/td>\n Type<\/b><\/td>\n Firefox Version<\/b><\/td>\n<\/tr>\n \n executeScript \/ registerContentScript<\/span> in moz-extension<\/span> documents<\/td>\n Deprecation \u2192 Removal<\/td>\n Deprecated 149, removed 152<\/td>\n<\/tr>\n \n File access opt-in<\/td>\n Change<\/td>\n 152<\/td>\n<\/tr>\n \n pageAction<\/span> SVG CSS filter<\/td>\n Removal<\/td>\n 152<\/td>\n<\/tr>\n \n openPopup()<\/span> without user activation<\/td>\n New capability<\/td>\n 149 (Desktop only)<\/td>\n<\/tr>\n \n splitViewId<\/span> on tabs.Tab<\/span><\/td>\n New API<\/td>\n 149<\/td>\n<\/tr>\n \n WebAuthn RP ID assertion<\/td>\n New capability<\/td>\n 150<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Need more?<\/b><\/h2>\n