Crash and remote code execution via __proto__ tampering — Mozilla

Mozilla developer Jesse Ruderman demonstrated that by tampering with the window.proto.proto object, one can cause the browser to place a lock on a non-native object, leading to a crash. Although we have not demonstrated such control, a determined attacker might be able to exploit this crash to run arbitrary code on a victim’s computer.