they also found a type confusion in firefox/ionmonkey, so you can go from random website to pwned very quickly.