PAC privilege escalation using Function.prototype.call — Mozilla

moz_bug_r_a4 reports that a malicious Proxy AutoConfig (PAC) server could serve a PAC script that can execute code with elevated privileges by setting the required FindProxyForURL function to the eval method on a privileged object that leaked into the PAC sandbox. By redirecting the victim to a specially-crafted URL – easily done since the PAC script controls which proxy to use – the URL “hostname” can be executed as privileged script.