But, given that (almost) everyone runs browsers for which the binaries, at least, are avaliable, it's relatively straightforward to come up with something that triggers the vulnerability.
And even if you don't know what browser they are using, you can make guesses. For example - if you have an image that's 102px wide and immediately to the right of an image that's 57px wide, at some point the CPU will probably add 57 and 102. Things like that.
But, given that (almost) everyone runs browsers for which the binaries, at least, are avaliable, it's relatively straightforward to come up with something that triggers the vulnerability.
And even if you don't know what browser they are using, you can make guesses. For example - if you have an image that's 102px wide and immediately to the right of an image that's 57px wide, at some point the CPU will probably add 57 and 102. Things like that.