security.sandbox.content.read_path_whitelist
security.sandbox.content.read_path_whitelist
I mean, Firefox even has a `security.turn_off_all_security_so_that_viruses_can_take_over_this_computer` pref (used in testing; you won't see it in about:config but IIRC you can manually add it. Don't.). Prefs that break security are not new :)
Defense in depth concept is not new either.
But yes, it seems to be something you can flip in production. The argument being that if you're in a position to flip prefs you already can break security in a million ways. It's not something you can accidentally flip either.
(The pref doesn't actually "let viruses take over the computer", it just turns off all the security checks)
Useful for some internal unit/integration tests for release and test builds, but really dangerous when pointed to the web.
The standard way to access files for extensions seems to be with Native Messaging: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Na...
Basically make the user install a small program on their PC, then your extension talks to that program, the program reads out the file that you need and then hands it back to your extension.