Demonstrating a VMware Guest-to-Host Escape
This exploit chain - first demonstrated at Pwn2Own 2017 - leverages a heap overflow in Microsoft Edge, a type confusion in the Windows kernel, and an uninitialized buffer in VMware Workstation for a complete virtual machine escape.