Type Confusion

chromium is vulnerable to Type Confusion. The vulnerability exists due to the system not verifying the type of object that is passed to it, and uses it blindly without type-checking...