It's also worth remembering that a complete exploit can often compose numerous "small" vulnerabilities into the realized breach. As such, it's easy to discount

It's also worth remembering that a complete exploit can often compose numerous "small" vulnerabilities into the realized breach. As such, it's easy to discount a seemingly hard-to-exploit vulnerability until you see it in action. It may be used in concert with other weaknesses or "widened" by an unforeseen technique. As a specific example, check out the two-part wrap-up of the Pwnium browser hacking competition[1] [2]. It's a great illustration of chaining weaknesses together to achieve a desired exploit. [1] http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.html http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.h... [2] http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.html http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.h...