A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `-moz-binding` CSS property. This property does not require the style sheet to have the same origin as the web page. The issue has been demonstrated by the compromise of a large number of LiveJournal accounts.