diff --git a/toolkit/components/extensions/webrequest/ChannelWrapper.cpp b/toolkit/components/extensions/webrequest/ChannelWrapper.cpp
index 4b8c84dc47f0..d0cea1e34554 100644
--- a/toolkit/components/extensions/webrequest/ChannelWrapper.cpp
+++ b/toolkit/components/extensions/webrequest/ChannelWrapper.cpp
@@ -500,20 +500,23 @@ ChannelWrapper::Matches(const dom::MozRequestFilter& aFilter,
       return false;
     }
 
+    // If this isn't the proxy phase of the request, check that the extension
+    // has origin permissions for origin that originated the request.
     bool isProxy = aOptions.mIsProxy && aExtension->HasPermission(nsGkAtoms::proxy);
-    if (!isProxy && IsSystemLoad()) {
-      return false;
-    }
-
-    if (auto origin = DocumentURLInfo()) {
-      nsAutoCString baseURL;
-      aExtension->GetBaseURL(baseURL);
-
-      if (!isProxy &&
-          !StringBeginsWith(origin->CSpec(), baseURL) &&
-          !aExtension->CanAccessURI(*origin)) {
+    if (!isProxy) {
+      if (IsSystemLoad()) {
         return false;
       }
+
+      if (auto origin = DocumentURLInfo()) {
+        nsAutoCString baseURL;
+        aExtension->GetBaseURL(baseURL);
+
+        if (!StringBeginsWith(origin->CSpec(), baseURL) &&
+            !aExtension->CanAccessURI(*origin)) {
+          return false;
+        }
+      }
     }
   }