The type confusion vulnerability allows a guest-to-host sandbox escape which can lead to remote code execution ...