Mikx

The issue allows remote attackers to execute arbitrary code via a <LINK rel="icon"> tag with a javascript: URL in the `href` attribute. This is related to the favicon functionality.

The issue allows remote attackers to bypass the security model by dragging a javascript: or data: URL to a tab, due to the failure of invoking the Javascript Security Manager. This is related to a technique known as "firetabbing."