The layout engine in Mozilla Firefox 2 and 3 before 3.0.7 Thunderbird before 2.0.0.21 and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to nsCSSStyleSheet::GetOwnerNode events and garbage collection which triggers memory corruption.