WARNING: We do not expect anyone to solve this challenge. It's extremely hard and not beginner-friendly. (TLDR: Don't waste your time here lmao)
This guy found a cool bug but didn't manage to get RCE, I believe you can though.
https://issues.chromium.org/issues/443475183
(NOTE: Patches only re-introduce the bug to latest stable release as well as remove some objects that would make it too easy. Inteded solution is to utilize the bug in the linked issue.)
1e1e0c88c55414e3ab7f98629a0233d3dc77fca0