Right. The first CVE gets you for example, cross window access. The second gets you system access outside of the sandbox.