Comment by lima

It would be chained with a separate 0day sandbox escape.