--- a/mobile/android/components/ImageBlockingPolicy.js
+++ b/mobile/android/components/ImageBlockingPolicy.js
@@ -3,16 +3,18 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 const Cm = Components.manager;
 
 ChromeUtils.import("resource://gre/modules/Services.jsm");
 ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm");
 ChromeUtils.import("resource://gre/modules/Timer.jsm");
 
+Cu.importGlobalProperties(["XMLHttpRequest"]);
+
 // //////////////////////////////////////////////////////////////////////////////
 // // Constants
 
 // // SVG placeholder image for blocked image content
 const PLACEHOLDER_IMG = "chrome://browser/skin/images/placeholder_image.svg";
 
 // // Telemetry
 const TELEMETRY_TAP_TO_LOAD_ENABLED = "TAP_TO_LOAD_ENABLED";
@@ -98,17 +100,17 @@ ImageBlockingPolicy.prototype = {
   observe: function(subject, topic, data) {
     if (topic == TOPIC_GATHER_TELEMETRY) {
       Services.telemetry.getHistogramById(TELEMETRY_TAP_TO_LOAD_ENABLED).add(this._enabled());
     }
   },
 };
 
 function sendImageSizeTelemetry(imageURL) {
-  let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"].createInstance(Ci.nsIXMLHttpRequest);
+  let xhr = new XMLHttpRequest();
   xhr.open("HEAD", imageURL, true);
   xhr.onreadystatechange = function(e) {
     if (xhr.readyState != 4) {
       return;
     }
     if (xhr.status != 200) {
       return;
     }

--- a/mobile/android/components/Snippets.js
+++ b/mobile/android/components/Snippets.js
@@ -1,16 +1,18 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 ChromeUtils.import("resource://gre/modules/Accounts.jsm");
 ChromeUtils.import("resource://gre/modules/Services.jsm");
 ChromeUtils.import("resource://gre/modules/XPCOMUtils.jsm");
 
+Cu.importGlobalProperties(["XMLHttpRequest"]);
+
 ChromeUtils.defineModuleGetter(this, "Home", "resource://gre/modules/Home.jsm");
 ChromeUtils.defineModuleGetter(this, "OS", "resource://gre/modules/osfile.jsm");
 ChromeUtils.defineModuleGetter(this, "Task", "resource://gre/modules/Task.jsm");
 ChromeUtils.defineModuleGetter(this, "UITelemetry", "resource://gre/modules/UITelemetry.jsm");
 
 
 XPCOMUtils.defineLazyGetter(this, "gEncoder", function() { return new gChromeWin.TextEncoder(); });
 XPCOMUtils.defineLazyGetter(this, "gDecoder", function() { return new gChromeWin.TextDecoder(); });
@@ -321,17 +323,17 @@ function removeStats() {
 
 /**
  * Helper function to make HTTP GET requests.
  *
  * @param url where we send the request
  * @param callback function that is called with the xhr responseText
  */
 function _httpGetRequest(url, callback) {
-  let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"].createInstance(Ci.nsIXMLHttpRequest);
+  let xhr = new XMLHttpRequest();
   try {
     xhr.open("GET", url, true);
   } catch (e) {
     Cu.reportError("Error opening request to " + url + ": " + e);
     return;
   }
   xhr.onerror = function onerror(e) {
     Cu.reportError("Error making request to " + url + ": " + e.error);

--- a/mobile/android/modules/SSLExceptions.jsm
+++ b/mobile/android/modules/SSLExceptions.jsm
@@ -1,15 +1,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 "use strict";
 
 ChromeUtils.import("resource://gre/modules/PrivateBrowsingUtils.jsm");
 
+Cu.importGlobalProperties(["XMLHttpRequest"]);
+
 this.EXPORTED_SYMBOLS = ["SSLExceptions"];
 
 /**
   A class to add exceptions to override SSL certificate problems. The functionality
   itself is borrowed from exceptionDialog.js.
 */
 function SSLExceptions() {
   this._overrideService = Cc["@mozilla.org/security/certoverride;1"]
@@ -43,17 +45,17 @@ SSLExceptions.prototype = {
 
   /**
     Attempt to download the certificate for the location specified to get the SSLState
     for the certificate and the errors.
    */
   _checkCert: function SSLE_checkCert(aURI) {
     this._sslStatus = null;
 
-    let req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"].createInstance(Ci.nsIXMLHttpRequest);
+    let req = new XMLHttpRequest();
     try {
       if (aURI) {
         req.open("GET", aURI.prePath, false);
         req.channel.notificationCallbacks = this;
         req.send(null);
       }
     } catch (e) {
       // We *expect* exceptions if there are problems with the certificate

--- a/mobile/android/tests/browser/robocop/robocop_testharness.js
+++ b/mobile/android/tests/browser/robocop/robocop_testharness.js
@@ -5,18 +5,17 @@
 
 function sendMessageToJava(message) {
   SpecialPowers.Services.androidBridge.dispatch(message.type, message);
 }
 
 function _evalURI(uri, sandbox) {
   // We explicitly allow Cross-Origin requests, since it is useful for
   // testing, but we allow relative URLs by maintaining our baseURI.
-  let req = SpecialPowers.Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
-                         .createInstance();
+  let req = new XMLHttpRequest();
 
   let baseURI = SpecialPowers.Services.io
                              .newURI(window.document.baseURI, window.document.characterSet);
   let theURI = SpecialPowers.Services.io
                             .newURI(uri, window.document.characterSet, baseURI);
 
   // We append a random slug to avoid caching: see
   // https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/Using_XMLHttpRequest#Bypassing_the_cache.