exploit development – TCmalloc heap exploitation

I can control the addresses of Freelist pointer during deallocation

https://github.com/marcinguy/CVE-2020-15999#update-7

Are there any TCMalloc Attacks that can turn this into RCE?

TCmalloc should have some basic, if any protections.

Confused also about Freelist in ThreadCache and Pageheap spans. Are Freelist actual addresses to memory objects with data? Can somebody explain it. How does TC Freelist works with Pageheap Spans?