WebKit before r53525 as used in Google Chrome before 4.0.249.89 allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed RUBY element as demonstrated by a <ruby>><table><rt> sequence.