AIKIDO-2026-167438

TL;DR

@locker/near-membrane-base implements the near-membrane boundary that isolates sandboxed code from the host realm. Sandboxed code can define an accessor property on a live target, which plants the sandbox-authored getter or setter directly on the raw host-shared object, so a later read from the host realm executes sandbox code with the raw object as receiver and exposes host-only state. Sandboxed code can also install an inherited numeric-index setter on Array.prototype so that the membrane's argument marshalling, which populates a plain array with [[Set]], invokes that setter and overwrites the marshalled foreign target pointer to redirect cross-boundary calls. Both flaws let untrusted sandboxed code escape the membrane and read or corrupt state in the host realm. The fix scopes accessor descriptors to the inert shadow target and marshals arguments with [[DefineOwnProperty]] instead of [[Set]].