diff --git a/dom/clients/manager/ClientOpenWindowUtils.cpp b/dom/clients/manager/ClientOpenWindowUtils.cpp
index 7d815768768..d9dab867d96 100644
--- a/dom/clients/manager/ClientOpenWindowUtils.cpp
+++ b/dom/clients/manager/ClientOpenWindowUtils.cpp
@@ -477,6 +477,16 @@ RefPtr<ClientOpPromise> ClientOpenWindow(
   nsCOMPtr<nsIPrincipal> principal = principalOrErr.unwrap();
   MOZ_DIAGNOSTIC_ASSERT(principal);
 
+  rv = nsContentUtils::GetSecurityManager()->CheckLoadURIWithPrincipal(
+      principal, uri, nsIScriptSecurityManager::DONT_REPORT_ERRORS, 0);
+  if (NS_FAILED(rv)) {
+    nsPrintfCString err("Opening \"%s\" is not allowed", aArgs.url().get());
+    CopyableErrorResult errResult;
+    errResult.ThrowTypeError(err);
+    promise->Reject(errResult, __func__);
+    return promise;
+  }
+
   nsCOMPtr<nsIContentSecurityPolicy> csp;
   nsCOMPtr<PolicyContainer> policyContainer;
   if (aArgs.cspInfo().isSome()) {