http://secure45nbquibuw6thmenrfamhobdkkrllgxrtayn4sgmnexremexyd.onion/firefox-chromium.html
Additionally, due to the lack of CFI in Firefox, there are
also many gadgets available for an attacker to force transition the mapping to executable, such as ExecutableAllocator::makeExecutable or mprotect / VirtualAlloc in the C library. Something similar to Safari's "Bulletproof JIT" would have been a better approach, utilising two separate mappings — one writable and one executable with the writable mapping being placed at...