--- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
@@ -5212,17 +5212,25 @@ this.XPIProvider = {
       // Add other stuff that extensions want.
       Object.assign(activeAddon.bootstrapScope, {Worker, ChromeWorker});
 
       // Define a console for the add-on
       XPCOMUtils.defineLazyGetter(
         activeAddon.bootstrapScope, "console",
         () => new ConsoleAPI({ consoleID: "addon/" + aId }));
 
-      Services.scriptloader.loadSubScript(uri, activeAddon.bootstrapScope);
+      // As we don't want our caller to control the JS version used for the
+      // bootstrap file, we run loadSubScript within the context of the
+      // sandbox with the latest JS version set explicitly.
+      activeAddon.bootstrapScope.__SCRIPT_URI_SPEC__ = uri;
+      Components.utils.evalInSandbox(
+        "Components.classes['@mozilla.org/moz/jssubscript-loader;1'] \
+                   .getService(Components.interfaces.mozIJSSubScriptLoader) \
+                   .loadSubScript(__SCRIPT_URI_SPEC__);",
+                   activeAddon.bootstrapScope, "ECMAv5");
     } catch (e) {
       logger.warn("Error loading bootstrap.js for " + aId, e);
     }
 
     // Only access BrowserToolboxProcess if ToolboxProcess.jsm has been
     // initialized as otherwise, when it will be initialized, all addons'
     // globals will be added anyways
     if (this._toolboxProcessLoaded) {
@@ -5304,18 +5312,18 @@ this.XPIProvider = {
       }
 
       // Nothing to call for locales
       if (aAddon.type == "locale")
         return;
 
       let method = undefined;
       try {
-        let scope = activeAddon.bootstrapScope;
-        method = scope[aMethod] || Cu.evalInSandbox(`${aMethod};`, scope);
+        method = Components.utils.evalInSandbox(`${aMethod};`,
+          activeAddon.bootstrapScope, "ECMAv5");
       } catch (e) {
         // An exception will be caught if the expected method is not defined.
         // That will be logged below.
       }
 
       // Extensions are automatically deinitialized in the correct order at shutdown.
       if (aMethod == "shutdown" && aReason != BOOTSTRAP_REASONS.APP_SHUTDOWN) {
         activeAddon.disable = true;