1. 3
  1.  

  2. 2

    This is very interesting, but the focus on tor browser is really weird. There are many possible browser faults that have nothing to do with arbitrary code execution.

    The code may be of interest too: https://github.com/immunant/selfrando