The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to \pollute XPCNativeWrappers\ and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element.