FWIW, I don't think we should be exposing what URL schemes the user has functionality for to the web even if there might be legitimate usage and we should try getting rid of it per the design Emilio and I came up with. I agree that we need to be careful about rolling this out, but I don't think it's an acceptable end state to keep leaking this forever. See also the discussion in https://github.com/mozilla/standards-positions/issues/213.
Bug 1658881 Comment 6 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
FWIW, I don't think we should be exposing what URL schemes the user has functionality for to the web even if there might be legitimate usage and we should try getting rid of it mostly per the design Emilio and I came up with. One adjustment we have to make for compatibility, as illustrated by bug 1650162, is that navigating the frame to such a URL scheme should still cause the new tab or app to be opened. I agree that we need to be careful about rolling this out, but I don't think it's an acceptable end state to keep leaking this forever. See also the discussion in https://github.com/mozilla/standards-positions/issues/213.