It was a javascript vulnerability, CVE-2013-1690. After free of a DocumentViewerImpl object, triggered via an specially crafted web page using onreadystatechange events and the window.stop() API, you could execute arbitrary code.<p><a href="http:&#x2F;&#x2F;resources.infosecinstitute.com&#x2F;fbi-tor-exploit&#x2F;" rel="nofollow">http:&#x2F;&#x2F;resources.infosecinstitute.com&#x2F;fbi-tor-exploit&#x2F;</a>