I mean that's the thing, they're layers deep but those layers can largely be approached individually, and swapped as needed. You don't have to wait until you f

I mean that's the thing, they're layers deep but those layers can largely be approached individually, and swapped as needed. You don't have to wait until you find a JS exploit to start work on a payload achieving further privilege escalation, you use existing development tools and privileges. And what's really so different in concert between SQL injection and the lack of proper checks on the binary data header field in the beginning of the first post? One of the latter posts in the linked series goes through how the initial stage stuff is in one case taken verbatim from the JS test case in the webkit commit fixing the bug (and only reaching users months later). (Not at all saying it's not incredibly impressive or that I could do any of it, haha)