AIKIDO-2026-873017

TL;DR

vm2 relays an embedder-exposed host-realm Promise into the sandbox through its bridge. Guest code overrides constructor[Symbol.species] on the raw host promise and calls .then/.catch/.finally with the settlement-direction handler omitted, so V8 substitutes an internal thrower that hands the raw host settlement value to a sandbox-captured capability. The rejection sanitizer is bypassed because it only neutralizes sandbox-realm promises and has no callback slot to intercept, letting guest code capture host references such as process and reach host code. The fix shadows the host promise's constructor so the result capability is always a genuine host Promise and extends the indirection peel to host Reflect.apply and .finally.