Exploiting browsers to gain access to userspace is fairly common in stuff like console jailbreaking.

And at that point you can proceed with the same kinds of kernel/driver exploits.