Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X Windows XP Windows Vista and iPhone before 1.0.1 allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.