A Chromium incorrect size calculation when deserializing Mojo "Event" messages can lead to out-of-bounds access. Continue reading...