You might not be able to escape the browser's sandbox, but you can certainly escape your tab's sandbox and spy on other tabs using timing attacks: https://www.usenix.org/system/files/conference/usenixsecurit...