--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -1960,27 +1960,16 @@ MediaManager::NotifyRecordingStatusChang
                                                                    requestURL,
                                                                    aIsAudio,
                                                                    aIsVideo);
   }
 
   return NS_OK;
 }
 
-bool MediaManager::IsPrivileged()
-{
-  bool permission = nsContentUtils::IsCallerChrome();
-
-  // Developer preference for turning off permission check.
-  if (Preferences::GetBool("media.navigator.permission.disabled", false)) {
-    permission = true;
-  }
-  return permission;
-}
-
 bool MediaManager::IsLoop(nsIURI* aDocURI)
 {
   MOZ_ASSERT(aDocURI);
 
   nsCOMPtr<nsIURI> loopURI;
   nsresult rv = NS_NewURI(getter_AddRefs(loopURI), "about:loopconversation");
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return false;
@@ -2069,17 +2058,19 @@ MediaManager::GetUserMedia(nsPIDOMWindow
 
   // Determine permissions early (while we still have a stack).
 
   nsIURI* docURI = aWindow->GetDocumentURI();
   if (!docURI) {
     return NS_ERROR_UNEXPECTED;
   }
   bool loop = IsLoop(docURI);
-  bool privileged = IsPrivileged();
+  bool isChrome = nsContentUtils::IsCallerChrome();
+  bool privileged = isChrome ||
+      Preferences::GetBool("media.navigator.permission.disabled", false);
   bool isHTTPS = false;
   docURI->SchemeIs("https", &isHTTPS);
   nsCString host;
   nsresult rv = docURI->GetHost(host);
   // Test for some other schemes that ServiceWorker recognizes
   bool isFile;
   docURI->SchemeIs("file", &isFile);
   bool isApp;
@@ -2112,19 +2103,21 @@ MediaManager::GetUserMedia(nsPIDOMWindow
     Telemetry::Accumulate(Telemetry::WEBRTC_GET_USER_MEDIA_SECURE_ORIGIN,
                           (uint32_t) GetUserMediaSecurityState::Localhost);
   } else {
     Telemetry::Accumulate(Telemetry::WEBRTC_GET_USER_MEDIA_SECURE_ORIGIN,
                           (uint32_t) GetUserMediaSecurityState::Other);
   }
 
   nsCString origin;
-  rv = nsPrincipal::GetOriginForURI(docURI, origin);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return rv;
+  if (!isChrome) {
+    rv = nsPrincipal::GetOriginForURI(docURI, origin);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
   }
 
   if (!Preferences::GetBool("media.navigator.video.enabled", true)) {
     c.mVideo.SetAsBoolean() = false;
   }
 
   MediaSourceEnum videoType = MediaSourceEnum::Other; // none
   MediaSourceEnum audioType = MediaSourceEnum::Other; // none

--- a/dom/media/MediaManager.h
+++ b/dom/media/MediaManager.h
@@ -256,17 +256,16 @@ public:
 
   typedef nsTArray<RefPtr<MediaDevice>> SourceSet;
   static bool IsPrivateBrowsing(nsPIDOMWindowInner* window);
 private:
   typedef media::Pledge<SourceSet*, dom::MediaStreamError*> PledgeSourceSet;
   typedef media::Pledge<const char*, dom::MediaStreamError*> PledgeChar;
   typedef media::Pledge<bool, dom::MediaStreamError*> PledgeVoid;
 
-  static bool IsPrivileged();
   static bool IsLoop(nsIURI* aDocURI);
   static nsresult GenerateUUID(nsAString& aResult);
   static nsresult AnonymizeId(nsAString& aId, const nsACString& aOriginKey);
 public: // TODO: make private once we upgrade to GCC 4.8+ on linux.
   static void AnonymizeDevices(SourceSet& aDevices, const nsACString& aOriginKey);
   static already_AddRefed<nsIWritableVariant> ToJSArray(SourceSet& aDevices);
 private:
   already_AddRefed<PledgeSourceSet>

--- a/dom/media/systemservices/CamerasParent.cpp
+++ b/dom/media/systemservices/CamerasParent.cpp
@@ -663,16 +663,20 @@ GetPrincipalFromOrigin(const nsACString&
 }
 
 // Find out whether the given origin has permission to use the
 // camera. If the permission is not persistent, we'll make it
 // a one-shot by removing the (session) permission.
 static bool
 HasCameraPermission(const nsCString& aOrigin)
 {
+  // Treat lack of origin as coming from browser chrome code, and allow.
+  if (!aOrigin.Length()) {
+    return true;
+  }
   // Name used with nsIPermissionManager
   static const char* cameraPermission = "camera";
   bool allowed = false;
   bool permanent = false;
   nsresult rv;
   nsCOMPtr<nsIPermissionManager> mgr =
     do_GetService(NS_PERMISSIONMANAGER_CONTRACTID, &rv);
   if (NS_SUCCEEDED(rv)) {