--- a/devtools/client/scratchpad/scratchpad.js
+++ b/devtools/client/scratchpad/scratchpad.js
@@ -1152,16 +1152,17 @@ var Scratchpad = {
    *        2) the data that was read from the file, if any.
    */
   importFromFile: function SP_importFromFile(aFile, aSilentError, aCallback)
   {
     // Prevent file type detection.
     let channel = NetUtil.newChannel({
       uri: NetUtil.newURI(aFile),
       loadingNode: window.document,
+      securityFlags: Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS,
       contentPolicyType: Ci.nsIContentPolicy.TYPE_OTHER});
     channel.contentType = "application/javascript";
 
     this.notificationBox.removeAllNotifications(false);
 
     NetUtil.asyncFetch(channel, (aInputStream, aStatus) => {
       let content = null;
 

--- a/devtools/client/styleeditor/StyleEditorUI.jsm
+++ b/devtools/client/styleeditor/StyleEditorUI.jsm
@@ -365,16 +365,17 @@ StyleEditorUI.prototype = {
     let onFileSelected = (selectedFile) => {
       if (!selectedFile) {
         // nothing selected
         return;
       }
       NetUtil.asyncFetch({
         uri: NetUtil.newURI(selectedFile),
         loadingNode: this._window.document,
+        securityFlags: Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS,
         contentPolicyType: Ci.nsIContentPolicy.TYPE_OTHER
       }, (stream, status) => {
         if (!Components.isSuccessCode(status)) {
           this.emit("error", { key: LOAD_ERROR });
           return;
         }
         let source =
             NetUtil.readInputStreamToString(stream, stream.available());

--- a/netwerk/base/NetUtil.jsm
+++ b/netwerk/base/NetUtil.jsm
@@ -139,17 +139,33 @@ this.NetUtil = {
         }
 
         let channel = aSource;
         if (!(channel instanceof Ci.nsIChannel)) {
             channel = this.newChannel(aSource);
         }
 
         try {
-            channel.asyncOpen(listener, null);
+            // Open the channel using asyncOpen2() if the loadinfo contains one
+            // of the security mode flags, otherwise fall back to use asyncOpen().
+            if (channel.loadInfo &&
+                channel.loadInfo.securityMode != 0) {
+                channel.asyncOpen2(listener);
+            }
+            else {
+                // Log deprecation warning to console to make sure all channels
+                // are created providing the correct security flags in the loadinfo.
+                // See nsILoadInfo for all available security flags and also the API
+                // of NetUtil.newChannel() for details above.
+                Services.console.logStringMessage(
+                    "Warning: NetUtil.asyncFetch() requires the channel to have " +
+                    "one of the security flags set in the loadinfo (see nsILoadInfo). " +
+                    "Please create channel using NetUtil.newChannel()");
+                channel.asyncOpen(listener, null);
+            }
         }
         catch (e) {
             let exception = new Components.Exception(
                 "Failed to open input source '" + channel.originalURI.spec + "'",
                 e.result,
                 Components.stack.caller,
                 aSource,
                 e

--- a/toolkit/components/places/tests/browser/browser_favicon_setAndFetchFaviconForPage.js
+++ b/toolkit/components/places/tests/browser/browser_favicon_setAndFetchFaviconForPage.js
@@ -28,16 +28,18 @@ function test() {
       aWin.close();
     });
   });
 
   function getIconFile(aCallback) {
     NetUtil.asyncFetch({
       uri: favIconLocation,
       loadUsingSystemPrincipal: true,
+      // XXXckerschb: remove securityFlags once imageLoader uses asyncOpen2()
+      securityFlags: Ci.nsILoadInfo.SEC_NORMAL,
       contentPolicyType: Ci.nsIContentPolicy.TYPE_INTERNAL_IMAGE
     }, function(inputStream, status) {
         if (!Components.isSuccessCode(status)) {
           ok(false, "Could not get the icon file");
           // Handle error.
           return;
         }