The type confusion bug can lead to V8 sandbox escape and control-flow hijacking of the host process. A critical-severity type ...