> You can take over the browser by chaining exploits. Sections 5.1 and 5.2 show two examples. 5.1 is XSS due to using document.write with a user provided strin

> You can take over the browser by chaining exploits. Sections 5.1 and 5.2 show two examples. 5.1 is XSS due to using document.write with a user provided string. That's not taking over the browser and is very much possible from JS (it's basically the prototypical XSS example from well before there was wasm). 5.2 is more serious but in node, not the browser, and is barely a chain (two exploits?). It's a way to get a string to eval() if eval() is available in one of the indirect functions. I think the authors also overstate the benefits of ASLR in that case. If that same code was running natively in a server and exposed to direct user input like that, it's very possible an RCE could be made to work. These examples are simple by design since they're just demonstrations that it's possible, so more sophisticated attacks are possible, but we also shouldn't over extrapolate from them.