Really, they escaped from two virtual machines, the JavaScript VM and the VMWare VM. Maybe give them half a VM-point for breaking the confines of the Windows process (if you take your OS textbook seriously, a process is an abstraction of a computer, so sort of a VM).