Context isolation bypass via nested unserializable return value

Internet Bug Bounty disclosed a bug submitted by marshallofsound: https://hackerone.com/reports/2138080 – Bounty: $2550