In the end the sandbox is there to provide some limited security even in presence of other vulnerabilities.

So I would say it's a security critical bug a sandbox escape and a building blog for an exploit but not a exploit by itself.

Anyway it's sill a security vulnerability.