Orange Tsai's Pwn2Own Berlin chain used five mishandled browser features and fewer than 100 lines of code.