React native runs in the native ecosystem through a js-native-bridge and calls platform specifics system calls. https://reactnative.dev/architecture/xplat-implementation react is the <Components /> stuff in js react-dom is the juice
https://googleprojectzero.blogspot.com/2019/04/virtually-unl... one of the many public browser RCE. Or look for the ps5 jailbreaks, the browser is the common denominator for most systems and its leaky as hell given that JS is dynamically typed and everything gets JIT-ed to hell (https://webkit.org/blog/3362/introducing-the-webkit-ftl-jit/) most exploits I've seen are about tricking webkit into type mismatching + JIT "invalidation". WASM open this hole even wider