Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2 Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects and execute arbitrary code with chrome privileges via vectors related to (1) the document.loadBindingDocument function and (2) XSLT.