If we were able to make the size of the current heap block in this structure larger than the threshold of 0x186A0 bytes and trigger CMemoryProtector::ProtectedFree, it is still possible to force a true freeing action and occupy the freed object with other data as we show in the following piece of javascript code in figure 6.    Figure 6. Javascript proof of concept to force freeing  When creating the anchor element, the debug logs are shown in figure 7.