The nsWindow implementation in the browser engine does not check the validity of an instance after event dispatching, allowing remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, as demonstrated by Mobile Firefox on Android.