Mozilla Firefox before 1.5.0.5 Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code via script that changes the standard Object() constructor to return a reference to a privileged object and calling \named JavaScript functions\ that use the constructor.