AIKIDO-2026-907567

TL;DR

The ExternalCopy constructor walks a caller-supplied transferList array twice and reuses the first walk's type check when casting during the second walk. Because array elements are re-read through property gets, an index getter can return a real ArrayBuffer to the validating walk and a different value to the unchecked cast, producing a type confusion with a controlled-address read and write. A guest holding a single reference can reach the ExternalCopy constructor and trigger this, escaping the isolate to crash or hijack control flow in the host process. The fix forbids JavaScript execution while processing values and transfer lists so accessors can no longer run during the copy.