Those security checks normally prevent Web authors using JavaScript from transferring information from a frame with the Web surfer's liberal security clearance to another frame belonging to the hostile Web site. JavaScript is a scripting language, designed by Netscape, that is used to prompt actions on a computer without a person's interaction. Frames are smaller windows within windows on Web sites. Computer users can use frames or full windows to access local files on their computer, which is why windows opened from the local disk have those liberal security restrictions. Cross-frame security checks are designed to protect those windows from being hijacked by hostile Web sites.
Cookies are text files that Web sites use to store information about a visitor for future reference.
Applications that rely on cookies include Web-based email applications, which use the technology to track how long a visitor has been logged into an account, and shopping carts, which keep track of items a shopper has opted to buy. Haselton said the exploit could be used to pilfer both bookmarks and cache information. The cache keeps copies of Web pages so that the browser does not have to make new queries to the same Web address to display repeatedly requested content. If I run the exploit on a specific person, I can determine what other sites they have visited. Netscape also disputed Haselton's claim that the hole exposed a user's cache files.