The flaws, demonstrated at the Pwn2Own Berlin contest, could allow attackers to exploit JavaScript engine weaknesses if users fail to update promptly.