AIKIDO-2026-546974

TL;DR

The PromiseRaw then, catch, and finally methods box a Rust callback and pass a raw pointer to a native trampoline that unconditionally reconstructs and drops the box on every invocation. Because JavaScript resolves then by name from the promise object, untrusted code can override Promise.prototype.then or supply a custom thenable that invokes the callback more than once. Repeated invocation double-frees the boxed callback, and finally can additionally leak memory depending on the invocation pattern. The fix redesigns callback ownership and finalization and adds error-path cleanup.