Vulnerability Instance

moz_bug_r_a4 discovered that .valueOf.call() and .valueOf.apply()
when called with no arguments were returning the Object class
prototype rather than the caller's global window object. When
called on a reachable property of another window this provides
a hook to get around the same-origin protection, allowing an
attacker to inject script into another window.Cross-site script injection can be used to steal confidential
data such as cookies or passwords, or perform actions on
the user's behalf. It can also be used to alter the content
of the other window which could be used to fool a user
into trusting bogus information or downloaded content.Thunderbird shares the JavaScript engine with Firefox
and could be vulnerable if JavaScript were to be enabled in mail. This is not
the default setting and we strongly discourage users from running
JavaScript in mail.