CVE-2026-92954: Vm2 Bridge Host Promise Unhandled At Apply Boundarycve-2026-92954-vm2-bridge-host-promise-unhandled-at-apply-boundary
The sandbox->host Proxy apply trap hands a host function's return value to the sandbox via thisFromOther($RET) without first marking the value as handled at the boundary. When a host function returns a rejected host-realm Promise (an embedder async function, Promise.reject, events.once, ...) and sandbox code ignores the result (no .then/.catch/.finally), the
