“In firefox running on X11, any script from any page can freely write to the primary selection, and that can be easily exploited to run arbitrary code on the user’s machine.”
Firefox fences the Ctrl-C clipboard behind secure contexts and a recent user click. The X11 primary selection, the one middle-click pastes into your terminal, has no fence at all. A background tab in a minimized window can plant a command and wait. Mozilla heard about it three weeks earlier and decided it wasn’t a real security issue, then rejected the reporter’s blocking add-on from addons.mozilla.org.