The 2008 Pwnie Award For Best Client-Side Bug

Multiple URL protocol handling flaws

Not just a few vulnerabilities, but an entire attack vector, URI protocol handler flaws pitted web browser and application vendors against each other as one web browser was exploitable through another and each vendor blamed the other for the vulnerability.