The impact of the vulnerability is limited though, as, in this case, it does not break the sandboxing of the applications and, as the instance of the browser is embedded, it does not have access to the cookies and other information accumulated by normal browser sessions.