Secunia (a well respected Danish Security firm) has posted a demonstration of a security flaw that affects both Internet Explorer and Firefox as of today. The flaw could allow a site to inject its own content into another site, thereby grabbing passwords or pin numbers etc.

The scenerio is that I go to a site and buy something with my paypal account. It then injects their password grabber into Paypal's website.

Here is the demo: Secunia Frame Injection Demo