Re: Something missing?
I'm not 100% sure on their statement as the report says
"you can create a popup without calling do_popupregister() by iframing popupfilltab.html (i.e. via moz-extension, ms-browser-extension, chrome-extension, etc)"
As many now use the Chromium backend (and it's reported on the Chromium blog), I'm not sure how valid a statement that is.