Let extensions show a web page inside an extension page safely (an embedded view API)

[mike-dev-t]

Extensions that make dashboards or new-tab pages sometimes need to show a live, signed-in website inside part of the page. Vivaldi does this natively with its web panels and dashboard. In Firefox, the only option for an extension is an iframe, and most sites block that with X-Frame-Options or CSP frame-ancestors. Add-on policy rightly forbids extensions from removing those headers, so today there’s no supported way to do it.

Idea: a browser-provided embedded view that an extension page can place and size, like a mini tab inside the page, where:

• the site loads as a real top-level page, so framing protections stay intact and clickjacking isn’t possible
• the extension can’t read or script the page’s contents
• the user approves each site once

This would let dashboard and productivity extensions offer what Vivaldi users get built in, without weakening anyone’s security.