As one of the owners of the Chrome Windows sandbox, that level of inaccuracy hurts to read. The correct statement is that Nils and Jon's pwn2own exploit bypasse

As one of the owners of the Chrome Windows sandbox, that level of inaccuracy hurts to read. The correct statement is that Nils and Jon's pwn2own exploit bypassed the sandbox by using a Windows kernel vulnerability that's exposed in every process on the system. You can argue about the extent to which you should be able to rely on the kernel to enforce its guarantees, but the component that failed isn't a point of debate.