From object transition to RCE in the Chrome renderer - The GitHub Blog

https://github.blog/security/vulnerability-research/from-object-transition-to-rce-in-the-chrome-renderer/