The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.

The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.

Firefox browser engine crashes Firefox double frame construction flaw Firefox JavaScript engine crashes Firefox URL spoofing with invalid unicode characters file: resources Firefox SSL tampering via non-200 responses to proxy CONNECT requests Firefox Race condition while accessing the private data of a NPObject JS wrapper class object Firefox arbitrary code execution flaw Firefox information disclosure flaw Firefox XUL scripts skip some security checks Firefox JavaScript arbitrary code execution