July 19, 2026 Headless Browser RCE, Part 2: Chaining Three JavaScriptCore Bugs Chaining three old JavaScriptCore bugs into a single-file RCE against Splash's QtWebKit engine, under W^X and ASLR.