--- a/netwerk/base/nsNetUtil.cpp
+++ b/netwerk/base/nsNetUtil.cpp
@@ -81,16 +81,17 @@
 #include <limits>
 
 using namespace mozilla;
 using namespace mozilla::net;
 
 #define DEFAULT_USER_CONTROL_RP 3
 
 static uint32_t sUserControlRp = DEFAULT_USER_CONTROL_RP;
+static bool sBlockRemoteJAR = true;
 
 already_AddRefed<nsIIOService>
 do_GetIOService(nsresult *error /* = 0 */)
 {
     nsCOMPtr<nsIIOService> io = mozilla::services::GetIOService();
     if (error)
         *error = io ? NS_OK : NS_ERROR_FAILURE;
     return io.forget();
@@ -2219,33 +2220,69 @@ NS_SecurityCompareURIs(nsIURI *aSourceUR
         return true;
     }
 
     if (!aTargetURI || !aSourceURI)
     {
         return false;
     }
 
+
+    static bool jarCachePrefInitialized = false;
+
+    if (!jarCachePrefInitialized) {
+      mozilla::Preferences::AddBoolVarCache(&sBlockRemoteJAR,
+                                            "network.jar.block-remote-files",
+                                            true);
+      jarCachePrefInitialized = true;
+    }
+
+    nsCOMPtr<nsIURI> targetBaseURI = aTargetURI;
     // We never consider nested targets to be same-origin.
-    nsCOMPtr<nsINestedURI> nestedTarget = do_QueryInterface(aTargetURI);
+    nsCOMPtr<nsINestedURI> nestedTarget = do_QueryInterface(targetBaseURI);
     if (nestedTarget) {
-      return false;
+      if (sBlockRemoteJAR) {
+        return false;
+      }
+      // ... unless we're not blocking remote JAR files, in which case we
+      // make an exception for jar: targets.
+      if (!sBlockRemoteJAR) {
+        bool targetIsJAR = false;
+        if (NS_SUCCEEDED(targetBaseURI->SchemeIs("jar", &targetIsJAR)) &&
+            targetIsJAR) {
+          nsCOMPtr<nsIURI> innerURI;
+          nestedTarget->GetInnerURI(getter_AddRefs(innerURI));
+          if (innerURI) {
+            // Check that the contents of the jar URI aren't nested:
+            nsCOMPtr<nsINestedURI> nestedInner = do_QueryInterface(innerURI);
+            if (nestedInner) {
+              return false;
+            }
+          } else {
+            // We should always have an inner URI.
+            return false;
+          }
+          // If we get here, we found an inner URI and it wasn't nested.
+          // Continue and check the inner URI:
+          targetBaseURI = innerURI;
+        }
+      }
     }
-
     // Only nested wyciwyg source URIs are allowed.
     nsCOMPtr<nsINestedURI> nestedSource = do_QueryInterface(aSourceURI);
     nsCOMPtr<nsIURI> sourceBaseURI = aSourceURI;
     if (nestedSource) {
       bool sourceWysiwyg = false;
       if (NS_SUCCEEDED(aSourceURI->SchemeIs("wyciwyg", &sourceWysiwyg)) &&
           sourceWysiwyg) {
         nsCOMPtr<nsIURI> innerURI;
         nestedSource->GetInnerURI(getter_AddRefs(innerURI));
+        // We should always have an inner URI.
         if (innerURI) {
-          // Check that the contents of the wyciwyg URI isn't nested:
+          // Check that the contents of the wyciwyg URI aren't nested:
           nsCOMPtr<nsINestedURI> nestedInner = do_QueryInterface(innerURI);
           if (nestedInner) {
             return false;
           }
           sourceBaseURI = innerURI;
         }
       } else {
         return false;
@@ -2256,17 +2293,16 @@ NS_SecurityCompareURIs(nsIURI *aSourceUR
     // The original source URI may have been wyciwyg, but no other form of nested URI.
 
     // If either uri is an nsIURIWithPrincipal
     nsCOMPtr<nsIURIWithPrincipal> uriPrinc = do_QueryInterface(sourceBaseURI);
     if (uriPrinc) {
         uriPrinc->GetPrincipalUri(getter_AddRefs(sourceBaseURI));
     }
 
-    nsCOMPtr<nsIURI> targetBaseURI = aTargetURI;
     uriPrinc = do_QueryInterface(targetBaseURI);
     if (uriPrinc) {
         uriPrinc->GetPrincipalUri(getter_AddRefs(targetBaseURI));
     }
 
     if (!sourceBaseURI || !targetBaseURI)
         return false;