This is possibly the most out of the box (ha!) Chrome sandbox escape technique I've ever heard of 🤯

"Compromised renderer can control your mouse and escape sbx"
issues.chromium.org/issues/37085...