Use-after-free in Google Chrome CSS layout engine

This repository is a small browser exploit proof-of-concept consisting of three files: an HTML page, a JavaScript exploit scaffold, and a CSS file. The overall purpose is to demonstrate a browser-engine memory corruption scenario tied to CSS container queries and DOM layout invalidation. In poc.html, a container-query rule hides #vulnerable_element when the container width drops below 400px. The script logic in pwn.js forces layout on the target element, shrinks the container from 500px to 300px, and forces another layout flush, matching the comment that the target element's LayoutObject may be freed mid-iteration. After the suspected corruption trigger, the code performs heap grooming by allocating 2000 div elements with a size-controlled attribute payload to reclaim freed memory with attacker-influenced contents. It then requests pointer lock and creates typed-array/DataView objects wrapped by SandboxMemoryManager, which exposes read64 and write64 methods intended as arbitrary memory access primitives once object corruption is achieved. The repository does not include a full exploit chain, sandbox escape, or RCE payload, and there are no network callbacks or external C2 endpoints. One notable inconsistency is that poc.html loads exploit.js, but the repository contains pwn.js; this suggests the PoC is incomplete or the script filename was changed without updating the HTML. Overall, this is a browser-side memory corruption PoC scaffold rather than a weaponized exploit.