Vulnerability Instance

Michal Zalewski demonstrated that setting location.hostname
to a value with embedded null characters can confuse the browsers domain
checks. Setting the value triggers a load, but the networking software reads
the hostname only up to the null character while other checks for "parent
domain" start at the right and so can have a completely different idea of what
the current host is.This cannot be used for a direct same-origin violation to perform cross-site
scripting: those checks are performed on the complete hostname including
the nulls. However, other mechanisms rely on matching parent domains and those
can be fooled by this trick. For example, this flaw allows a malicious page
to set domain cookies for any arbitrary site, which might be useful in a
session-fixation attack. This also allows setting document.domain to any
arbitrary value which could be used to perform a cross-site scripting
attack against any page which also sets document.domain.