Got me confused for a sec, as the exploit in the top comment implies JavaScript→root, but it actually relies on two separate exploits.