--- a/layout/tools/reftest/manifest.jsm
+++ b/layout/tools/reftest/manifest.jsm
@@ -633,32 +633,43 @@ function ServeTestBase(aURL, depth) {
     // Give the testbase URI access to XUL and XBL
     Services.perms.add(testbase, "allowXULXBL", Services.perms.ALLOW_ACTION);
     return testbase;
 }
 
 function CreateUrls(test) {
     let secMan = Cc[NS_SCRIPTSECURITYMANAGER_CONTRACTID]
                     .getService(Ci.nsIScriptSecurityManager);
+    let chromeReg = Cc["@mozilla.org/chrome/chrome-registry;1"]
+                      .getService(Ci.nsIChromeRegistry);
 
     let manifestURL = g.ioService.newURI(test.manifest);
     let principal = secMan.createCodebasePrincipal(manifestURL, {});
 
     let testbase = manifestURL;
     if (test.runHttp)
         testbase = ServeTestBase(manifestURL, test.httpDepth)
 
     function FileToURI(file)
     {
         if (file === null)
             return file;
 
         var testURI = g.ioService.newURI(file, null, testbase);
         secMan.checkLoadURIWithPrincipal(principal, testURI,
                                          Ci.nsIScriptSecurityManager.DISALLOW_SCRIPT);
+
+        // Load XUL files from "chrome:" URIs to run them with privileges.
+        if (testURI.spec.endsWith(".xul")) {
+          let chromeURI = g.ioService.newURI("chrome://reftest-file/content" +
+                                             testURI.pathQueryRef);
+          chromeReg.registerChromeURLOverrideForTest(chromeURI, testURI);
+          return chromeURI;
+        }
+
         return testURI;
     }
 
     let files = [test.url1, test.url2];
     [test.url1, test.url2] = files.map(FileToURI);
 
     return test;
 }

--- a/layout/tools/reftest/reftest-content.js
+++ b/layout/tools/reftest/reftest-content.js
@@ -1085,16 +1085,28 @@ function DoAssertionCheck()
         numAsserts = newAssertionCount - gAssertionCount;
         gAssertionCount = newAssertionCount;
     }
     SendAssertionCount(numAsserts);
 }
 
 function LoadURI(uri)
 {
+    if (uri.startsWith("chrome:")) {
+        // Register the override in the content process too.
+        let chromeReg = Cc["@mozilla.org/chrome/chrome-registry;1"]
+                          .getService(Ci.nsIChromeRegistry);
+        let ioService = Cc["@mozilla.org/network/io-service;1"]
+                         .getService(Ci.nsIIOService);
+        let chromeURI = ioService.newURI(uri);
+        let testURI = ioService.newURI("file://" +
+                      chromeURI.pathQueryRef.replace("/content/", "/"));
+        chromeReg.registerChromeURLOverrideForTest(chromeURI, testURI);
+    }
+
     var flags = webNavigation().LOAD_FLAGS_NONE;
     webNavigation().loadURI(uri, flags, null, null, null);
 }
 
 function LogError(str)
 {
     if (gVerbose) {
         sendSyncMessage("reftest:Log", { type: "error", msg: str });