CVE 2010-0650
WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event.
See the 
CVE page on Mitre.org
for more details.
