I'm developing a Firefox add-on and it involves reading the pixel image data off of arbitrary images on the web. 

With Chrome, Safari, and Opera, this is as simple as loading the image on a canvas in the background page (getImageData works and ignores same-origin restriction). But on Firefox, using the add-on SDK, creating a ["trusted" page-worker](https://developer.mozilla.org/en-US/Add-ons/SDK/High-Level_APIs/page-worker#Scripting_trusted_page_content) and calling getImageData on images loaded from arbitrary URLs yields a security errors. 

```
- message = The operation is insecure.
- name = SecurityError
- result = 2152923154

```

I've been flipping through the documentation for the Add-on SDK and from other StackOverflow answers, and it seems that content scripts are typically still bound by the same-origin policy. The PrivilegeManager/enablePrivilege (I'm not even sure this is relevant) seems to have been deprecated. 

The only way I can currently imagine is the low-level net/xhr [XMLHttpRequest](https://developer.mozilla.org/en-US/Add-ons/SDK/Low-Level_APIs/net_xhr) API with a requestType of Blob and loading the image with a createObjectURL. But this seems a bit unnecessarily convoluted, when I feel like there should be some way to just call getImageData without bumping against the same-origin-policy in a privileged context.