Google Chrome HTMLKeygenElement::shadowSelect() Type Confusion

Google Chrome suffers from a HTMLKeygenElement::shadowSelect() type confusion vulnerability.