An alleged SSL/TLS protocol vulnerability

Note that this attack does not require injecting JavaScript into the SSL site. The man-in-the-middle just has to inject JavaScript into any plain HTTP site open at the same time, and from there that JavaScript can poke at the SSL site in a way that helps the man-in-the-middle packet sniffer figure out how to decrypt your SSL session.