--- a/docshell/base/nsDSURIContentListener.cpp
+++ b/docshell/base/nsDSURIContentListener.cpp
@@ -138,16 +138,25 @@ nsDSURIContentListener::DoContent(const 
                                   bool* aAbortProcess)
 {
   nsresult rv;
   NS_ENSURE_ARG_POINTER(aContentHandler);
   NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
 
   *aAbortProcess = false;
 
+  // do not allow loads from external protocols if specified by the docshell
+  bool allowExternalProtocols = true;
+  rv = mDocShell->GetAllowExternalProtocols(&allowExternalProtocols);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!allowExternalProtocols) {
+    return NS_ERROR_ABORT;
+  }
+
   // determine if the channel has just been retargeted to us...
   nsLoadFlags loadFlags = 0;
   nsCOMPtr<nsIChannel> aOpenedChannel = do_QueryInterface(aRequest);
 
   if (aOpenedChannel) {
     aOpenedChannel->GetLoadFlags(&loadFlags);
 
     // block top-level data URI navigations if triggered by the web

--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -356,16 +356,17 @@ nsDocShell::nsDocShell()
   , mAllowJavascript(true)
   , mAllowMetaRedirects(true)
   , mAllowImages(true)
   , mAllowMedia(true)
   , mAllowDNSPrefetch(true)
   , mAllowWindowControl(true)
   , mAllowContentRetargeting(true)
   , mAllowContentRetargetingOnChildren(true)
+  , mAllowExternalProtocols(true)
   , mUseErrorPages(false)
   , mObserveErrorPages(true)
   , mAllowAuth(true)
   , mAllowKeywordFixup(false)
   , mIsOffScreenBrowser(false)
   , mIsActive(true)
   , mDisableMetaRefreshWhenInactive(false)
   , mIsAppTab(false)
@@ -2041,16 +2042,30 @@ NS_IMETHODIMP
 nsDocShell::SetAllowContentRetargetingOnChildren(
     bool aAllowContentRetargetingOnChildren)
 {
   mAllowContentRetargetingOnChildren = aAllowContentRetargetingOnChildren;
   return NS_OK;
 }
 
 NS_IMETHODIMP
+nsDocShell::GetAllowExternalProtocols(bool* aAllowExternalProtocols)
+{
+  *aAllowExternalProtocols = mAllowExternalProtocols;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsDocShell::SetAllowExternalProtocols(bool aAllowExternalProtocols)
+{
+  mAllowExternalProtocols = aAllowExternalProtocols;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 nsDocShell::GetInheritPrivateBrowsingId(bool* aInheritPrivateBrowsingId)
 {
   *aInheritPrivateBrowsingId = mInheritPrivateBrowsingId;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDocShell::SetInheritPrivateBrowsingId(bool aInheritPrivateBrowsingId)

--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -1099,16 +1099,17 @@ private: // data members
   bool mAllowJavascript : 1;
   bool mAllowMetaRedirects : 1;
   bool mAllowImages : 1;
   bool mAllowMedia : 1;
   bool mAllowDNSPrefetch : 1;
   bool mAllowWindowControl : 1;
   bool mAllowContentRetargeting : 1;
   bool mAllowContentRetargetingOnChildren : 1;
+  bool mAllowExternalProtocols : 1;
   bool mUseErrorPages : 1;
   bool mObserveErrorPages : 1;
   bool mAllowAuth : 1;
   bool mAllowKeywordFixup : 1;
   bool mIsOffScreenBrowser : 1;
   bool mIsActive : 1;
   bool mDisableMetaRefreshWhenInactive : 1;
   bool mIsAppTab : 1;

--- a/docshell/base/nsIDocShell.idl
+++ b/docshell/base/nsIDocShell.idl
@@ -344,16 +344,22 @@ interface nsIDocShell : nsIDocShellTreeI
 
   /**
    * True if new child docshells should allow content retargeting.
    * Setting allowContentRetargeting also overwrites this value.
    */
   [infallible] attribute boolean allowContentRetargetingOnChildren;
 
   /**
+   * If set to false, docshells should not allow loads performed by external
+   * protocols
+   */
+  attribute boolean allowExternalProtocols;
+
+  /**
    * True if this docShell should inherit the private browsing ID from
    * its parent when reparented.
    *
    * NOTE: This should *not* be set false in new code, or for docShells
    * inserted anywhere other than as children of panels.
    */
   [infallible] attribute boolean inheritPrivateBrowsingId;
 

--- a/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js
+++ b/toolkit/components/thumbnails/content/backgroundPageThumbsContent.js
@@ -35,16 +35,17 @@ const backgroundPageThumbsContent = {
     // etc - so set it to the lowest priority available.
     this._webNav.QueryInterface(Ci.nsIDocumentLoader).
       loadGroup.QueryInterface(Ci.nsISupportsPriority).
       priority = Ci.nsISupportsPriority.PRIORITY_LOWEST;
 
     docShell.allowMedia = false;
     docShell.allowPlugins = false;
     docShell.allowContentRetargeting = false;
+    docShell.allowExternalProtocols = false;
     let defaultFlags = Ci.nsIRequest.LOAD_ANONYMOUS |
                        Ci.nsIRequest.LOAD_BYPASS_CACHE |
                        Ci.nsIRequest.INHIBIT_CACHING |
                        Ci.nsIWebNavigation.LOAD_FLAGS_BYPASS_HISTORY;
     docShell.defaultLoadFlags = defaultFlags;
     docShell.sandboxFlags |= SANDBOXED_AUXILIARY_NAVIGATION;
 
     addMessageListener("BackgroundPageThumbs:capture",