Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into (1) performing a \View Image\ on a broken image in which the SRC attribute contains a Javascript URL or (2) selecting \Show only this frame\ on a frame whose SRC attribute contains a Javascript URL.