Cross-site scripting (XSS) vulnerability in WebKit as used in Apple iOS before 5 and Safari before 5.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows.