Why Firefox 57 Replaced XUL and XPCOM with WebExtensions

In November 2017, Mozilla released Firefox 57, codenamed Firefox Quantum, which permanently dropped support for legacy XUL and XPCOM extensions in favor of the new WebExtensions API. This monumental shift was driven by the urgent need to modernize the browser's core architecture, improve performance through multi-process capabilities, enhance user security, and simplify cross-browser extension development. While the transition broke compatibility with many beloved, deeply integrated add-ons, it was a necessary evolution to ensure Firefox remained fast, stable, and competitive in the modern web landscape.

The Fragility of XUL and XPCOM

For years, Firefox used XUL (XML User Interface Language) and XPCOM (Cross Platform Component Object Model) to build both the browser itself and its extensions. This meant legacy extensions were not restricted by a defined set of rules; instead, they had direct, unrestricted access to Firefox’s internal code.

While this allowed developers to modify almost any aspect of the browser, it created a massive maintenance problem. Because there was no separation between the browser's core code and the extensions, routine Firefox updates frequently broke add-ons. Conversely, poorly written extensions could easily destabilize or crash the entire browser.

Enabling Multi-Process Architecture and Firefox Quantum

Modern web browsers split tasks across multiple CPU processes to keep the browser responsive if a single web page freezes. Mozilla's initiative to bring this multi-process architecture to Firefox was called Project Electrolysis (e10s), which culminated in the high-performance Firefox 57 Quantum update.

Legacy XUL and XPCOM extensions were built under the assumption that Firefox ran on a single process. They directly manipulated the user interface and web content simultaneously, which caused severe performance bottlenecks and compatibility failures when multiple processes were introduced. Deprecating these legacy systems allowed Mozilla to fully implement multi-process rendering and integrate new, high-speed engine components written in the Rust programming language.

Enhancing Browser Security

Unrestricted access to browser internals posed a severe security risk. Because XPCOM allowed extensions to execute low-level system commands and read local files, a malicious extension—or a legitimate extension that was compromised—had total control over the user's browser and potentially their operating system.

The WebExtensions API solved this by introducing a strict permissions model and sandboxing. With WebExtensions, add-ons can only interact with the browser through safe, predefined pathways (APIs). Users are also explicitly informed of what permissions an extension requires before installation, drastically reducing the risk of malware and data theft.

Faster Browser Development

Before Firefox 57, Mozilla engineers had to tiptoe around legacy extensions whenever they wanted to update the browser's interface or underlying engine. Changing a single line of internal code could break thousands of add-ons, slowing down Firefox's innovation.

By moving to WebExtensions, Mozilla created a wall between the browser's internal code and the extension ecosystem. As long as Mozilla maintains the WebExtensions API, engineers are free to completely rewrite the internal workings of Firefox without worrying about breaking user add-ons.

Cross-Browser Compatibility

Previously, developing an extension for Firefox required learning XUL and XPCOM, technologies used by no other major browser. Developers who created extensions for Google Chrome, Microsoft Edge, or Opera had to rewrite their code from scratch to support Firefox, leading many to ignore Firefox entirely.

The WebExtensions API was specifically designed to be compatible with the extension standard used by Chromium-based browsers. This standardization allowed developers to write an extension once and deploy it across Firefox, Chrome, and Edge with minimal changes, ultimately revitalizing the Firefox add-on ecosystem and bringing more developers back to the platform.