I HAD SOME FREE TIME, SO I TRIED TO PWN V8

Summary from the TLDR newsletter

This developer chained three public V8 bugs against the exact Chrome build used in Google's v8CTF. The first bug leaked a compressed object address, the second turned a garbage collection mistake into a fake JavaScript array and read/write access inside the V8 cage, and the third used a JSPI and JS Dispatch Table mismatch to pivot the native stack outside that cage. The developer then reused code already inside Chrome to open, read, and print the flag.