[berkes]

Row hammer is an exploit. It wasn't "by design".

While that may technically be "escaping the sandbox" it's a different case, because it was never meant to work, will be fixed and often is fixed.

[afiori]

Almost every "escaping the sandbox" is due to some kind of bug.

Sure if the PDF standard exposed a "globalThis.runBlobAsNativeExecutable" function it would be worse, but it is still escaping the sandbox.