CVE-2026-44008: Sandbox Bridge Array Index Assign Bypasses Reflect Definecve-2026-44008-sandbox-bridge-array-index-assign-bypasses-reflect-define
`$ARR[$ARR.length] = $VAL` appends to an array via an ordinary index assignment, which walks `Array.prototype` before creating an own slot. In sandbox or cross-realm bridge code, an array literal `[]` allocated inside a closure shared with the untrusted realm inherits that realm's `Array.prototype`. An attacker can pre-install a numeric-index setter (e.g. `O
