"The noexec bypass uses user mount namespaces with pid mapping to mount a tmpfs directory, which does not have the noexec flag applied, and this mount is then
accessed via the /proc/${PID}/cwd directory from outside the namespace, allowing a temporary executable mount. This mount also does not have the nosuid flag
applied, but it can only be read/written by the chronos user (or root), so this is not useful without another exploit (e.g root command execution to drop a
setuid shell)"