diff --git a/toolkit/content/widgets/tabbrowser.xml b/toolkit/content/widgets/tabbrowser.xml
index 11f4908ff349..6b0dc35e524a 100644
--- a/toolkit/content/widgets/tabbrowser.xml
+++ b/toolkit/content/widgets/tabbrowser.xml
@@ -783,8 +783,13 @@
               Components.interfaces.nsIScriptSecurityManager;
 
             try {
-              secMan.checkLoadURI(origURI, uri,
-                                  nsIScriptSecMan.DISALLOW_SCRIPT);
+              // error pages can load their favicon
+              // to be on the safe side, only allow chrome:// favicons
+              const aboutNeterr = "about:neterror?";
+              if (origURI.spec.substr(0, aboutNeterr.length) != aboutNeterr ||
+                  !uri.schemeIs("chrome"))
+                secMan.checkLoadURI(origURI, uri,
+                                    nsIScriptSecMan.DISALLOW_SCRIPT);
             } catch(e) {
               return;
             }
diff --git a/xpfe/global/resources/content/bindings/tabbrowser.xml b/xpfe/global/resources/content/bindings/tabbrowser.xml
index e40c92a6e6ca..addd2dd7af4b 100644
--- a/xpfe/global/resources/content/bindings/tabbrowser.xml
+++ b/xpfe/global/resources/content/bindings/tabbrowser.xml
@@ -705,8 +705,13 @@
               Components.interfaces.nsIScriptSecurityManager;
 
             try {
-              secMan.checkLoadURI(origURI, uri,
-                                  nsIScriptSecMan.DISALLOW_SCRIPT);
+              // error pages can load their favicon
+              // to be on the safe side, only allow chrome:// favicons
+              const aboutNeterr = "about:neterror?";
+              if (origURI.spec.substr(0, aboutNeterr.length) != aboutNeterr ||
+                  !uri.schemeIs("chrome"))
+                secMan.checkLoadURI(origURI, uri,
+                                    nsIScriptSecMan.DISALLOW_SCRIPT);
             } catch(e) {
               return;
             }