Cross-Site JavaScript Injection in Firefox and SeaMonkey by Mozilla

CVE-2006-1741

Summary

This vulnerability allows remote attackers to execute arbitrary JavaScript on other websites by manipulating event handlers during the page load process. By leveraging modal alerts, a new page load can suspend the handling of events, creating a window of opportunity for attackers to inject malicious scripts through various methods such as eval() and extensions of eval using window.proto. This exposes users to potential threats, fundamentally altering how web content is rendered and interacted with.

References