Type Confusion

chromium is vulnerable to Type Confusion. The vulnerability exists due to the system not verifying the type of object that is passed to it, and uses it blindly without type-checking...

Crash when using web workers with asm.js — Mozilla

Soeren Balko reported a crash when terminating a web worker running asm.js code after passing an object between threads. This crash is potentially exploitable...