title: In Firefox, use a plugin or extension to invoke "unsafe" APIs?
body: <p>Firefox extensions can invoke privileged APIs (e.g. nsIProcess to start an external app) without bugging the user, for example this extension does it from the download window: <a href="https://addons.mozilla.org/en-US/firefox/addon/10902/" rel="nofollow">https://addons.mozilla.org/en-US/firefox/addon/10902/</a></p>
  
  <p>I need to do the same kind of thing, but from a UI on a web page. Can an extension provide a XUL widget (which calls the privileged APIs via a component module) that I can instantiate in the page DOM? Or do I need to write a plugin?</p>