After obtaining a primitive, how do you use that to do things you should not be able to? In this presentation I introduce new techniques to bypass the Windows Restricted Token and AppContainer isolation mitigations. Both are used in Chrome and Microsoft Edge renderer processes ;P