PoC: File/dir picker obscured by PiP

RCE/sandbox escape with compromised renderer, while showing another tab (popup + PiP opened from background tab)

Opens calc.exe and cmd.exe with arbitrary arguments (e.g. ping example.com)

Seems like payload can be anything that would work in Win+R, so use your imagination (powershell, mshta, etc).