WebKit as used in Google Chrome before 10.0.648.204 and Apple Safari before 5.0.6 does not properly handle node parentage which allows remote attackers to cause a denial of service (DOM tree corruption) conduct cross-site scripting (XSS) attacks or possibly have unspecified other impact via unknown vectors.