• info
• discussion
• exploit
• solution
• references

Mozilla Firefox OnUnload Memory Corruption Vulnerability

The following proof of concept is available:

http://lcamtuf.coredump.cx/ietrap/testme.html