One of the hackers who demonstrated exploit code for a vulnerability in the way the Firefox browser handles JavaScript at a hacker conference in San Diego admitted today that the presentation was meant to be a joke, according to Mozilla Corp.'s chief of security. Mozilla security researchers spent most of Sunday and yesterday scrambling to determine if exploit code revealed during a presentation by hackers Mischa Spiegelmock and Andrew Wbeelsoi at Toorcon over the weekend could allow someone to execute malicious code through a memory corruption attack on Firefox.

However, Window Snyder, who leads Mozilla's security team, said Spiegelmock admitted to the company that the presentation was meant to be humorous, and he and Wbeelsoi had not actually achieved remote execution with the exploit code demonstrated at the show.

"At best, in some cases it will crash only the client," Snyder said. "That's all we've been able to verify at this point."

Spiegelmock, who works for Six Apart Ltd., confirmed as much in his LiveJournal blog, in which he includes a link to a statement he made that is posted on Snyder's Mozilla blog.