Three chained zero-days and roughly 40,000 dollars in model charges delivered code execution outside the browser sandbox on Windows.