Privilege escalation using named-functions and redefined "new Object()"
- July 25, 2006
- Firefox, SeaMonkey, Thunderbird
- Fixed in
- Firefox 18.104.22.168
- SeaMonkey 1.0.3
- Thunderbird 22.214.171.124
Our fix involves calling the internal Object constructor which appears to be what other ECMA-compatible interpreters do.