WebKit suffers from a universal cross site scripting vulnerability in JSObject::putInlineSlow and JSValue::putToPrimitive.