PoC: File/dir picker obscured by PiP

RCE/sandbox escape with compromised renderer

Opens calc.exe and cmd.exe with arbitrary arguments (e.g. ping example.com)

Seems like payload can be anything that would work in Win+R, so use your imagination (powershell, mshta, etc).

<marquee>like it's 1999!</marquee>