AIKIDO-2026-10848

TL;DR

The sandbox stack-trace formatter appends frames with lines[lines.length] = value, invoking sandbox Array.prototype setters during bridge-internal work. That violates Defense Invariant #11 and lets untrusted code observe each formatted frame line. Today the captured value is a string, but the pattern matches prior species-based escapes. The fix uses prototype-bypassing property writes like other hardened bridge sites.