CVE-2026-44009: Sandbox Array Prototype Setter Leakcve-2026-44009-sandbox-array-prototype-setter-leak
Appending to an array with `$ARR[$ARR.length] = $VAL` invokes [[Set]], which traverses the prototype chain. If Array.prototype[N] has an attacker-installed setter (e.g., from sandbox/cross-realm code), that setter receives the appended value — potentially including sensitive internal state — before the caller regains control. Use Reflect.defineProperty or Ob
