CVE-2026-92955: Js Sandbox Bridge Host Proto Getter Not Deniedcve-2026-92955-js-sandbox-bridge-host-proto-getter-not-denied
Incomplete mitigation of the host-realm `Object.prototype.__proto__` accessor: only the raw setter is handed to the dangerous-host-function deny registry ($DENY($DESC.set)); the raw getter is never denied delivery to sandbox code. Attacker-controlled sandbox code can therefore extract the raw host proto-reader (e.g. via a host Function.prototype.call/apply i
