Ah I wasn't aware of that, what do these priveliged APIs do?

Things like history management. While tabs in browser.html are just iframes, browser.html needs more access to the contained documents to be able to fully do its job. For security reasons, you can't get at an iframe's current location/title/favicon if the loaded document is from another domain. We need this information to show a proper title in the title bar and the tabs list, and to show a back button and things like that.

In addition, the browser needs to act as a sort of broker between sites and the OS. Storing cookies and session data, showing notifications or dialogs, and entering fullscreen mode are just a few examples of this. (Note that most of these things aren't even implemented yet. Browsers are complex applications in their own right, even after accounting for the browser engine.)

The main one is mozbrowser which has some documentation here: https://developer.mozilla.org/en-US/docs/Web/API/Using_the_B...

We are deliberately trying to keep this to the bare minimum, and will likely try and find someway to standardize those few things we do if possible.

Punch through CORS like it's a sheet of paper, for example.