Comment by roywiggins

> I chained this bug with an n-day sandbox escape and flagged the v8CTF.

https://serotav.github.io/Writeups/v8/when-sorting-leads-to-...