[benhawkes]

We probably should have linked to this in the post, but you can see the details of Ivan's findings on our public issue tracker: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

As expected from DOM fuzzing there's lots of overflows, use-after-free, and type confusion issues.