Firefox: fix script injection"