A critical isolated-vm flaw lets untrusted JavaScript escape the V8 sandbox and potentially hijack the host process.