Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix
Yet another reason to use an extension like uMatrix to disallow javascript by default, and only allow the absolute minimum that sites you trust need to function.