Mozilla Foundation Security Advisory 2009-31
Title: XUL scripts bypass content-policy checks
Announced: June 11, 2009
Reporter: Wladimir Palant
Products: Firefox, Thunderbird, SeaMonkey
Fixed in: Firefox 3.0.11
Mozilla add-on developer and community member Wladimir Palant reported that content-loading policies were not checked before loading external script files into XUL documents. The severity of this problem would depend on the reasons behind the content policy check, which include privacy from "web bugs" in Thunderbird mail messages, blocking of Ads and Ad-server tracking in AdBlock Plus.
The original version of this advisory incorrectly claimed that NoScript protection could by bypassed; NoScript was unaffected.