Accessing XBL compilation scope via valueOf.call() — Mozilla

moz_bug_r_a4 discovered that the compilation scope of privileged built-in XBL bindings was not fully protected from web content and could be accessed by calling valueOf.call() and valueOf.apply() on a method of that binding. This could then be used to compile and run attacker-supplied JavaScript, giving it the privileges of the binding which would allow an attacker to install malware such as viruses and password sniffers.