By using document.appendChild to add stuff to an about:blank document, a web page can cause about:* to load (because checkloaduri will then pass the same-domain test). We can't view its contents though, because that check is stricter. .appendChild (and other dom methods?) probably needs to do what document.write does when writing to about:blank, and change the document url to that of the page doing the writing.

oops, wrong component -> dom core

Over to mstoltz based on discussion with him.

Upping the priority on this one as it's more exploitable than I thought.

Its still not readable from a script though, is it?

Yes it is, when combined with bug 94551. Fix coming soon (for this bug).

Remove the extra line just after the if statement: + if(nsCRT::strcasecmp(scheme, aboutScheme) == 0) + *aScheme = PL_strdup(scheme); + { (cut n' paste?) with that, sr=jst

Fix checked in.

verified 2001-09-12-05. securitymanager raised flag which is shown in console..

Removing NS_Confidential flag.