@-moz-document support has been dropped except for empty url-prefix()

Published: | Categories: CSS, Privacy & Security

Description

The @-moz-document rule is no longer available from Web content since it could be used by attackers for CSS injection to steal private data in the URL of third-party sites. Firefox users are still able to use this rule in the user stylesheet to personalize their browsing experience.

The at-rule support has already been removed from Nightly and early Beta/DevEdition as of Firefox 59, and removed from all the channels with Firefox 61.

An exception is the empty url-prefix function that has been used as a CSS hack targeting Firefox. It continues to be parsed on the Release channel to avoid breakages but will be removed in the near future once major compatibility issues are solved.

References