Chrome V8 JIT suffers from a type confusion vulnerability in GetSpecializationContext. Continue reading...