--- a/common/src/Overlays.jsm
+++ b/common/src/Overlays.jsm
@@ -470,17 +470,17 @@ class Overlays {
    */
   fetchOverlay(srcUrl) {
     if (!srcUrl.startsWith("chrome://") && !srcUrl.startsWith("resource://")) {
       throw new Error(
         "May only load overlays from chrome:// or resource:// uris"
       );
     }
 
-    let xhr = new XMLHttpRequest();
+    let xhr = new this.window.XMLHttpRequest();
     xhr.overrideMimeType("application/xml");
     xhr.open("GET", srcUrl, false);
 
     // Elevate the request, so DTDs will work. Should not be a security issue since we
     // only load chrome, resource and file URLs, and that is our privileged chrome package.
     try {
       xhr.channel.owner = Services.scriptSecurityManager.getSystemPrincipal();
     } catch (ex) {