[tedunangst]

What's meant is that real exploits require one to get RCE, another to break sandbox, another for privilege escalation.

[tptacek]

Also maybe an infoleak to set up the RCE.