Hack worked by stitching together three separate exploits.

https://arstechnica.com/security/201...00-at-pwn2own/