0-day sandbox escape (1)