Those vulnerable sites included domains owned by Google, Facebook, Microsoft, and Symantec, all of which the researchers contacted to alert the companies to the new Webbug.
The tool takes advantage of cross-site scripting, a common bug in Web sites that takes control of a user's browser when he or she clicks on a specially crafted link, or in some cases, simply visits a compromised page.