The exploit was made in the c-ares function, that was running on the HTTP proxy that was running as root (and on the same system). The attack requires javascrip

The exploit was made in the c-ares function, that was running on the HTTP proxy that was running as root (and on the same system). The attack requires javascript and an evil webserver; its not a fully local exploit.