Comment by bsmartt

fine, but that then requires a google chrome sandbox escape or visiting an attacker controlled page, my point was just that the initial claim was rather oversimplified.