TLDR: 1. Inbox currently using XSS right now, it is disabled by default in firefox. Refer: https://developer.mozilla.org/en-US/docs/Web/Security/CSP 2. Firebox has option to enable XSS, so inbox can work on it. But that allows XSS attacks.