diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 052731b39cd..7d5a25905da 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -1305,8 +1305,10 @@
           <![CDATA[
             var url = transferUtils.retrieveURLFromData(aXferData.data, aXferData.flavour.contentType);
 
-            // valid urls don't contain spaces ' '; if we have a space it isn't a valid url so bail out
-            if (!url || !url.length || url.indexOf(" ", 0) != -1)
+            // valid urls don't contain spaces ' '; if we have a space it isn't a valid url.
+            // Also disallow dropping javascript: or data: urls--bail out
+            if (!url || !url.length || url.indexOf(" ", 0) != -1 ||
+                /^\s*(javascript|data):/.test(url))
               return;
 
             var bgLoad = this.mPrefs.getBoolPref("browser.tabs.loadInBackground");