The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe. This occurs when designMode is enabled, causing a reference to a deleted controller context object.