https://mxr.mozilla.org/mozilla-central/source/widget/cocoa/nsSound.mm#59 calls NS_NewStreamLoader(). When we add the loadInfo to this channel in bug 1038756, we set the loadingPrincipal to systemPrincipal. Per https://bugzilla.mozilla.org/show_bug.cgi?id=1038756#c171, Gecko code doesn't call this API. If addons aren't using this API, we can remove it. If they are, then this bug is to figure out how to get them to pass the right loadingPrincipal and/or fallback to something more restrictive than systemPrincipal (maybe we can pass nullPrincipal).
You need to log in before you can comment on or make changes to this bug.