It seems there was a bug in some profiling code (that was left behind?). This code made it possible to write arbitrary files on the system, which they fixed by

It seems there was a bug in some profiling code (that was left behind?). This code made it possible to write arbitrary files on the system, which they fixed by removing the profiling code. This is the commit that fixes that: http://src.chromium.org/viewvc/chrome?view=rev&revision=161037 http://src.chromium.org/viewvc/chrome?view=rev&revision=... The SVG exploit was in Webkit, don't know the exact problem with that