diff --git a/netwerk/base/nsSimpleNestedURI.cpp b/netwerk/base/nsSimpleNestedURI.cpp
index 5274499227d..e255c885642 100644
--- a/netwerk/base/nsSimpleNestedURI.cpp
+++ b/netwerk/base/nsSimpleNestedURI.cpp
@@ -132,9 +132,31 @@ bool nsSimpleNestedURI::Deserialize(const mozilla::ipc::URIParams& aParams) {
   if (!nsSimpleURI::Deserialize(params.simpleParams())) return false;
 
   mInnerURI = DeserializeURI(params.innerURI());
+  if (!mInnerURI || !IsValidInnerURI(mInnerURI)) {
+    return false;
+  }
+
   return true;
 }
 
+bool nsSimpleNestedURI::IsValidInnerURI(nsIURI* aInnerURI) {
+  if (!Scheme().EqualsLiteral("view-source")) {
+    return false;
+  }
+
+  nsAutoCString innerSpec;
+  if (NS_FAILED(aInnerURI->GetAsciiSpec(innerSpec))) {
+    return false;
+  }
+
+  nsAutoCString pathQueryRef;
+  if (NS_FAILED(GetPathQueryRef(pathQueryRef))) {
+    return false;
+  }
+
+  return innerSpec == pathQueryRef;
+}
+
 // nsINestedURI
 
 NS_IMETHODIMP
diff --git a/netwerk/base/nsSimpleNestedURI.h b/netwerk/base/nsSimpleNestedURI.h
index 719eb30d1b8..aa3a5a3e42f 100644
--- a/netwerk/base/nsSimpleNestedURI.h
+++ b/netwerk/base/nsSimpleNestedURI.h
@@ -51,6 +51,10 @@ class nsSimpleNestedURI : public nsSimpleURI, public nsINestedURI {
   nsresult SetQuery(const nsACString& aQuery) override;
   nsresult SetRef(const nsACString& aRef) override;
   bool Deserialize(const mozilla::ipc::URIParams&);
+
+  // Returns true if aInnerURI is the inner URI our own spec implies.
+  virtual bool IsValidInnerURI(nsIURI* aInnerURI);
+
   nsresult ReadPrivate(nsIObjectInputStream* stream);
 
  public:
diff --git a/netwerk/protocol/about/nsAboutProtocolHandler.cpp b/netwerk/protocol/about/nsAboutProtocolHandler.cpp
index b9ff235f357..82822d0fc67 100644
--- a/netwerk/protocol/about/nsAboutProtocolHandler.cpp
+++ b/netwerk/protocol/about/nsAboutProtocolHandler.cpp
@@ -352,6 +352,29 @@ bool nsNestedAboutURI::Deserialize(const mozilla::ipc::URIParams& aParams) {
   return true;
 }
 
+bool nsNestedAboutURI::IsValidInnerURI(nsIURI* aInnerURI) {
+  if (!Scheme().EqualsLiteral("about")) {
+    return false;
+  }
+
+  if (!NS_IsContentAccessibleAboutURI(this)) {
+    return false;
+  }
+
+  nsAutoCString expectedSpec;
+  if (NS_FAILED(GetPathQueryRef(expectedSpec))) {
+    return false;
+  }
+  expectedSpec.InsertLiteral("moz-safe-about:", 0);
+
+  nsAutoCString innerSpec;
+  if (NS_FAILED(aInnerURI->GetAsciiSpec(innerSpec))) {
+    return false;
+  }
+
+  return innerSpec == expectedSpec;
+}
+
 // nsSimpleURI
 /* virtual */ already_AddRefed<nsSimpleURI> nsNestedAboutURI::StartClone() {
   NS_ENSURE_TRUE(mInnerURI, nullptr);
diff --git a/netwerk/protocol/about/nsAboutProtocolHandler.h b/netwerk/protocol/about/nsAboutProtocolHandler.h
index f5af1509b6f..65c42837bf0 100644
--- a/netwerk/protocol/about/nsAboutProtocolHandler.h
+++ b/netwerk/protocol/about/nsAboutProtocolHandler.h
@@ -76,6 +76,7 @@ class nsNestedAboutURI final : public nsSimpleNestedURI {
  protected:
   nsCOMPtr<nsIURI> mBaseURI;
   bool Deserialize(const mozilla::ipc::URIParams&);
+  bool IsValidInnerURI(nsIURI* aInnerURI) override;
   nsresult ReadPrivate(nsIObjectInputStream* stream);
 
  public: