AIKIDO-2026-217467

TL;DR

vm2 wraps Promise.prototype.then and related methods to sanitize values crossing the sandbox boundary, but a V8 optimization merges consecutive prototype assignments without invalidating an internal protector. As a result Promise.prototype.finally() follows a fast path that trusts the stale protector and skips sanitization. Sandboxed code uses a fulfilled promise with a controlled species and a calibrated stack overflow to obtain a host-realm error, reach the host Function constructor, and execute code with host privileges. The fix invalidates the protector correctly and wraps Promise.prototype.finally.