[justinschuh]

There was a type confusion in WebKit that got code execution inside the sandbox, and then a Windows kernel vulnerability to break out.