The issue arises from the JSSubScriptLoader not properly handling XPCNativeWrappers during calls to the `loadSubScript` method in an add-on. This makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior.