diff --git a/toolkit/components/webextensions/test/xpcshell/test_match_pattern_schemes.js b/toolkit/components/webextensions/test/xpcshell/test_match_pattern_schemes.js
new file mode 100644
index 0000000000..1afc7b5bcf
--- /dev/null
+++ b/toolkit/components/webextensions/test/xpcshell/test_match_pattern_schemes.js
@@ -0,0 +1,26 @@
+"use strict";
+
+add_task(function* test_explicit_webextension_schemes() {
+  let {MatchPattern} = Cu.import("resource://gre/modules/MatchPattern.jsm", {});
+  let patterns = [
+    ["moz-extension://6e20d047-ef47-41c0-a95f-93aa35f1798d/web_accessible_resources/*",
+     "moz-extension://6e20d047-ef47-41c0-a95f-93aa35f1798d/web_accessible_resources/file.js"],
+    ["ws://*/*", "ws://example.com/socket"],
+    ["wss://*/*", "wss://example.com/socket"],
+  ];
+
+  for (let [pattern, url] of patterns) {
+    let matcher = new MatchPattern(pattern);
+    ok(matcher.matches(Services.io.newURI(url, null, null)),
+       `explicit scheme is accepted: ${pattern}`);
+  }
+});
+
+add_task(function* test_wildcard_remains_web_only() {
+  let {MatchPattern} = Cu.import("resource://gre/modules/MatchPattern.jsm", {});
+  let matcher = new MatchPattern("*://*/*");
+  ok(!matcher.matches(Services.io.newURI("ws://example.com/socket", null, null)),
+     "scheme wildcard does not implicitly include WebSockets");
+  ok(!matcher.matches(Services.io.newURI("moz-extension://example/", null, null)),
+     "scheme wildcard does not include extension URLs");
+});
diff --git a/toolkit/components/webextensions/test/xpcshell/xpcshell.ini b/toolkit/components/webextensions/test/xpcshell/xpcshell.ini
index 7abf9fe3cd..bad1b67f13 100644
--- a/toolkit/components/webextensions/test/xpcshell/xpcshell.ini
+++ b/toolkit/components/webextensions/test/xpcshell/xpcshell.ini
@@ -9,6 +9,7 @@ tags = webextensions
 
 [test_csp_custom_policies.js]
 [test_webrequest_backend.js]
+[test_match_pattern_schemes.js]
 [test_webnavigation_created_target.js]
 [test_csp_validator.js]
 [test_ext_alarms.js]
diff --git a/toolkit/modules/addons/MatchPattern.jsm b/toolkit/modules/addons/MatchPattern.jsm
index 4dff81fd23..8c09a509e6 100644
--- a/toolkit/modules/addons/MatchPattern.jsm
+++ b/toolkit/modules/addons/MatchPattern.jsm
@@ -18,7 +18,11 @@ this.EXPORTED_SYMBOLS = ["MatchPattern", "MatchGlobs", "MatchURLFilters"];
 
 /* globals MatchPattern, MatchGlobs */
 
-const PERMITTED_SCHEMES = ["http", "https", "file", "ftp", "data"];
+// Keep explicit scheme support broad enough for WebExtensions, while the
+// match-pattern wildcard remains restricted to web content schemes below.
+const PERMITTED_SCHEMES = ["http", "https", "file", "ftp", "data",
+                           "ws", "wss", "moz-extension"];
+const ALL_URLS_SCHEMES = ["http", "https", "file", "ftp", "data", "ws", "wss"];
 const PERMITTED_SCHEMES_REGEXP = PERMITTED_SCHEMES.join("|");
 
 // This function converts a glob pattern (containing * and possibly ?
@@ -40,7 +44,7 @@ function globToRegexp(pat, allowQuestion) {
 // https://developer.chrome.com/extensions/match_patterns
 function SingleMatchPattern(pat) {
   if (pat == "<all_urls>") {
-    this.schemes = PERMITTED_SCHEMES;
+    this.schemes = ALL_URLS_SCHEMES;
     this.hostMatch = () => true;
     this.pathMatch = () => true;
   } else if (!pat) {