V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear.
replyhttps://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...
I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.
replygreat link, thanks
reply