Even if firefox was running under a different UID, they would still have to grant it access to the X server via xhost/xauth or whatever. They have certainly mi

Even if firefox was running under a different UID, they would still have to grant it access to the X server via xhost/xauth or whatever. They have certainly misunderstood the attack. Claiming this has zero utility is effectively saying sandboxing is useless, which is just plain wrong. Congratulations to Mozilla for getting this shipped!