Why Firefox Restricts Extensions with Quarantined Domains

This article provides a quick overview of Mozilla Firefox’s Quarantined Domains feature and explains why the browser restricts extensions on sensitive websites by default. Introduced in Firefox 115, this security measure blocks third-party add-ons from running on specific high-risk websites to protect user privacy, prevent financial fraud, and stop malicious actors from exploiting browser vulnerabilities. Below, we examine the mechanics of Quarantined Domains, the exact reasons Mozilla restricts extension access on certain sites, and how users can manage these settings.

What is the Quarantined Domains Feature?

Quarantined Domains is a built-in security feature in the Firefox web browser that prevents web extensions from functioning on a specific, Mozilla-maintained list of websites. Even if a user has granted an extension permission to "Access your data for all websites," the Quarantined Domains protocol overrides this permission for the sites on the restricted list.

The feature operates dynamically. Mozilla can update the list of quarantined domains remotely without requiring the user to update their browser. When you visit a quarantined domain, your installed extensions are temporarily paused or blocked from injecting scripts, reading page data, or modifying the content of that specific tab. Extensions that have been specifically vetted under Mozilla's Recommended Extensions program are occasionally exempt from these restrictions, provided they meet strict security standards.

Why Firefox Restricts Extensions on Sensitive Websites

Browser extensions require significant privileges to function correctly, such as the ability to read and modify everything you type and view on a webpage. While most extensions use these permissions legitimately, malicious actors frequently create or hijack extensions to steal sensitive information. Firefox restricts extensions on certain websites by default for several critical reasons:

1. Protecting High-Value Targets

Cybercriminals often design malicious extensions to target specific websites, such as online banking portals, cryptocurrency exchanges, and government tax platforms. By quarantining these domains, Firefox ensures that even if a user accidentally installs a malicious add-on, that add-on cannot read passwords, hijack sessions, or alter transaction details on those sensitive sites.

2. Securing Browser Integrity

Even before the Quarantined Domains feature existed, Firefox restricted extensions from running on its own internal pages and Mozilla-owned websites, such as addons.mozilla.org. If extensions were allowed to run on the Firefox Add-ons website, a single malicious extension could silently install more malware, fake user reviews, or prevent the user from accessing the menu required to uninstall the rogue extension.

3. Rapid Response to New Threats

Previously, if Mozilla discovered that a group of malicious extensions was targeting a specific website to steal user data, engineers had to locate and ban each extension individually. Attackers would simply upload new copies of the extension to bypass the ban. Quarantined Domains flips this dynamic. Instead of playing whack-a-mole with thousands of rogue extensions, Mozilla can immediately quarantine the targeted website, instantly neutralizing the attack vector for all Firefox users.

4. Preventing Paywall and Security Bypasses

In some cases, websites suffer from specific vulnerabilities in how they interact with browser extensions, leading to severe data leaks. Quarantining the domain gives the website administrators time to fix their underlying security flaws while keeping Firefox users safe in the interim.

How to Manage Quarantined Domains

While the default restrictions are designed to protect the vast majority of users, advanced users may occasionally want a trusted extension—such as a password manager or an ad blocker—to run on a restricted site. Firefox allows users to override these restrictions either per extension or globally.

To allow a specific extension on restricted sites:

  1. Enter about:addons in the Firefox address bar and press Enter.
  2. Click on the extension you wish to modify.
  3. Scroll down to the Run on sites with restrictions option.
  4. Select Allow.

To disable the Quarantined Domains feature entirely:

  1. Enter about:config in the Firefox address bar and press Enter.
  2. Click Accept the Risk and Continue.
  3. Search for the preference extensions.quarantinedDomains.enabled.
  4. Double-click the preference to change its value from true to false.