Google Chrome LinkToTextMenuObserver::CompleteWithError Use After Free

This strike exploits a vulnerability in Google Chrome. Specifically, LinkToTextMenuObserver holds a pointer to a RenderFrameHost object, but does not properly observe when FrameHost destruction events occur. Because of this, if an attacker manages to craft javascript in such a way that will destroy the frame host at the right time, a use after free condition can occur in LinkToTextMenuObserver::CompleteWithError. When this happens a denial of service condition, or potentially remote code execution, may occur.