@geoffreyirving on Backlist

A Firefox NaN sandbox escape found by Mythos

A floating-point NaN bit pattern could masquerade as a tagged pointer across a Firefox sandbox boundary, making a numerical edge case into an exploit primitive