cross-site scripting through window.controllers
shutdown demonstrated how to use the window.controllers array to bypass
same-origin protections, allowing a malicious site to inject script into
content from another site. This could allow the malicious page to steal
information such as cookies or passwords from the other site, or perform
transactions on the user's behalf if the user were already logged in.
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.