Amazing writeup. An attack from top (javascript) to bottom (kernel bugs), while very clearly explaining the discovery and exploit of vulnerability in each layer. The attack is very impressive, and the writeup makes it seem easy, which is a great compliment on the clarity of the writing.

Of course, and as mentioned at the end, the actual discovery process was much messier :)

As a bonus, there are a lot of links to other interesting documents as well.