AIKIDO-2026-229227

TL;DR

Object::unwrap::<T>(), Object::remove_wrapped::<T>(), and their deprecated compat-mode twins validate a payload by reading a TypeId from its first bytes, which only holds for payloads created by Object::wrap. When a JavaScript-controlled object is passed instead, the code reads the TypeId from an incompatible allocation and can read past its end, then dereferences or detaches the forged payload. This yields out-of-bounds heap reads and JavaScript-forgeable out-of-bounds writes. The fix records wrapped payloads in a registry and checks membership before any TypeId read.