--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -2328,17 +2328,17 @@ InitializeLegacyNetscapeObject(JSContext
   NS_ENSURE_TRUE(obj, false);
 
   // We hide enablePrivilege behind a pref because it has been altered in a
   // way that makes it fundamentally insecure to use in production. Mozilla
   // uses this pref during automated testing to support legacy test code that
   // uses enablePrivilege. If you're not doing test automation, you _must_ not
   // flip this pref, or you will be exposing all your users to security
   // vulnerabilities.
-  if (!Preferences::GetBool("security.turn_off_all_security_so_that_viruses_can_take_over_this_computer")) {
+  if (!xpc::IsInAutomation()) {
     return true;
   }
 
   /* Define PrivilegeManager object with the necessary "static" methods. */
   obj = JS_DefineObject(aCx, obj, "PrivilegeManager", nullptr);
   NS_ENSURE_TRUE(obj, false);
 
   return JS_DefineFunctions(aCx, obj, EnablePrivilegeSpec);

--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -3757,19 +3757,17 @@ private:
 
 bool IsUniversalXPConnectEnabled(JSCompartment* compartment);
 bool IsUniversalXPConnectEnabled(JSContext* cx);
 bool EnableUniversalXPConnect(JSContext* cx);
 
 inline void
 CrashIfNotInAutomation()
 {
-    const char* prefName =
-      "security.turn_off_all_security_so_that_viruses_can_take_over_this_computer";
-    MOZ_RELEASE_ASSERT(mozilla::Preferences::GetBool(prefName));
+    MOZ_RELEASE_ASSERT(IsInAutomation());
 }
 
 inline XPCWrappedNativeScope*
 ObjectScope(JSObject* obj)
 {
     return CompartmentPrivate::Get(obj)->scope;
 }
 

--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -20,16 +20,17 @@
 #include "nsWrapperCache.h"
 #include "nsStringGlue.h"
 #include "nsTArray.h"
 #include "mozilla/dom/JSSlots.h"
 #include "mozilla/fallible.h"
 #include "nsMathUtils.h"
 #include "nsStringBuffer.h"
 #include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/Preferences.h"
 
 class nsGlobalWindow;
 class nsIPrincipal;
 class nsScriptNameSpaceManager;
 class nsIMemoryReporterCallback;
 
 namespace mozilla {
 namespace dom {
@@ -577,16 +578,27 @@ extern void
 GetCurrentCompartmentName(JSContext*, nsCString& name);
 
 JSRuntime*
 GetJSRuntime();
 
 void AddGCCallback(xpcGCCallback cb);
 void RemoveGCCallback(xpcGCCallback cb);
 
+inline bool
+IsInAutomation()
+{
+    const char* prefName =
+      "security.turn_off_all_security_so_that_viruses_can_take_over_this_computer";
+    char *s;
+    return mozilla::Preferences::GetBool(prefName) &&
+        (s = getenv("MOZ_DISABLE_NONLOCAL_CONNECTIONS")) &&
+        !!strncmp(s, "0", 1);
+}
+
 } // namespace xpc
 
 namespace mozilla {
 namespace dom {
 
 /**
  * A test for whether WebIDL methods that should only be visible to
  * chrome or XBL scopes should be exposed.