Comment by quaffcode

It seemed to be that they may not have disclosed everything they discovered, so as not to admit to their own "unauthorized access" to a computer. They stated they got credentials for the cnc server but using it would be unauth access - they implied they didn't.

But they did explain some of the infection nonetheless. A COM exploit on Windows for one.

Browsers are pretty well insulated from arbitrary code execution on the host machine, but I bet android has more vulnerabilities. It wasn't long ago that the webp zero day could pwn anyones device who just looked at an infected webp. (Also Israeli spyware, I believe). Similarily, if Windows apps have ad banners, there could be zero days there as well.