AIKIDO-2026-11068

TL;DR

The deserialize function in the structured-clone polyfill reconstructs values by calling new globalThis[name](value) where the constructor name comes from the serialized input. When an application passes attacker-controlled serialized data to deserialize, the attacker can request constructors such as Function, eval, Worker, SharedWorker, setTimeout, or setInterval and trigger code execution in the host environment. The code did not validate the constructor name. The patch introduces a guard that throws TypeError for these dangerous constructors before instantiation.