Not OP, but JS engine JIT bugs are pretty common.

https://phrack.org/issues/70/exploiting-logic-bugs-in-javasc...

https://www.sentinelone.com/vulnerability-database/cve-2026-...

https://projectzero.google/2020/09/jitsploitation-one.html

https://www.zerodayinitiative.com/blog/2021/12/6/two-birds-w...