Remote New Tab pages have access to internal browser APIs in Firefox 52
It is possible that remote New Tab pages have access to internal browser APIs in Firefox 52.
PreviewProvider Messaging API (https://bugzilla.mozilla.org/show_bug.cgi?id=1239119), NewTabPrefsProvider Messaging API (https://bugzilla.mozilla.org/show_bug.cgi?id=1239118), and PlacesProvider Messaging API (https://bugzilla.mozilla.org/show_bug.cgi?id=1239116)
are relevant. The content signature service (https://bugzilla.mozilla.org/show_bug.cgi?id=1252882) is important in this picture, too.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information