XPInstall (Cross-Platform Install) is a technology used by the Mozilla Application Suite, SeaMonkey, Mozilla Firefox, Mozilla Thunderbird and other XUL-based applications for installing Mozilla extensions that add functionality to the main application.^[1][2]

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages) This article needs additional citations for verification. (February 2024) This article needs to be updated. (December 2016)

A XPI (pronounced "zippy" and derived from XPInstall) installer module is a ZIP file that contains an install script or a manifest at the root of the file, and a number of data files.^[1][2]

In Mozilla, Firefox before 0.7, and before 0.5^{[clarification needed]}, the package contained a JavaScript install script (install.js) with some directives for actions to take during an install, including adding files and directories, removing old or obsolete files and directories, executing command line tools, etc. In middle-old Firefox and Thunderbird versions, the install script has been replaced by a chrome manifest and a RDF file (install.rdf). Since Firefox version 45, the only mandatory file is manifest.json.

Since Firefox 1.0, XPIs from sites other than Mozilla Add-ons are blocked by default. This was an attempt to prevent malicious programs, like computer viruses, Trojans and spyware, from being installed by novice users. While it is possible to put a site into the whitelist that limits sites which can install XPIs, malicious sites cannot install extensions in the background (without human intervention). This is because a confirmation dialog needs to be answered for every single installation of an extension.

However, users are still advised to install extensions from trusted sources only.

• Mozilla Archive Format