The Journey from exploiting PartitionAlloc to escaping the sandbox: Chromium Fullchain - 0CTF 2020

https://blog.perfect.blue/Chromium-Fullchain