Chrome and Chromium-based browsers (including Electron apps) accept command-line flags that can be abused for argument injection.
It can be used to break out from the intended program by running non-interactive system commands.
The --gpu-launcher flag executes a command. This is particularly relevant for Electron applications.
chrome '--gpu-launcher="id>/tmp/foo"'