The docshell implementation in Mozilla Firefox before 29.0 Firefox ESR 24.x before 24.5 Thunderbird before 24.5 and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property and conduct cross-site scripting (XSS) attacks via a crafted web site that performs history navigation.