Johnny Stenback

The issue allows remote attackers to bypass intended access restrictions via crafted JavaScript code, due to improper restriction of calls to DOMWindowUtils (aka nsDOMWindowUtils) methods.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via event handlers. This can be exploited to execute malicious scripts on a user's browser.

The issue allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, which is related to privilege escalation via incorrect principals.

The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption in the JavaScript engine.

The issue affects the XML parser, allowing remote attackers to cause a denial of service, potentially leading to a crash, and possibly read sensitive data. This is achieved through unknown attack vectors that trigger an out-of-bounds read.