Browser Development • Pale Moon automatically requesting CSS and JS files after JSON responses. Bug?

When Pale Moon gets a JSON response back from a web URL, it renders the JSON as text (expected) but then automatically requests two additional files from the domain:

CODE:

/css/main.css/lib/require.js

I've created a test file on my domain so you can see this in action. (It was difficult to find an example otherwise, but you're welcome to find somewhere else to test if you can.)

Steps to reproduce:

1. Open a new browser tab in Pale Moon.
2. Press F12 to open the dev tools in the newly opened tab.
3. Click the "Network" button in the dev tools to navigate to the Network dev panel.
4. Visit this test URL: https://www.sr20-forum.com/test_json_endpoint.php
5. Notice the browser window shows the JSON response.
6. Notice the network tab shows a 200 response, and the raw response header shows content-type: application/json.
7. Notice the two additional files mentioned above are automatically requested by the browser and fail with 404 responses (because those files don't exist on the domain).

For full context, the complete contents of test_json_endpoint.php are:

CODE:

<?php $data = array(); $data['name'] = 'Testing Pale Moon and how it may automatically ask for /css/main.css and /lib/require.js when being fed a JSON reply.'; header('Content-Type: application/json'); echo json_encode($data);

I've tested with Waterfox and the only additional automatic request sent is for /favicon.ico. Funnily enough, Waterfox's request for the favicon and it being blocked by my CSP are both Firefox bugs: https://stackoverflow.com/questions/698 ... on-firefox . I assume Chromium and other similar browsers don't ask for these files, but let me go check... Edit: Ungoogled Chromium does not ask for the CSS or JS file, just incorrectly (IMO) asks for /favicon.ico.

Is there a reason Pale Moon is automatically tacking on extra requests? This doesn't seem to make any sense to me, and was very surprising when I noticed it. My web site showed logged requests from my IP that I absolutely did not initiate, and I thought I'd been compromised for a bit there until I figured it out.

I guess it could be one of my few extensions doing this... I'm happy to provide more details, but I suspect it will be an easy thing to reproduce for everyone here.