CVE-2026-92942: Js Sandbox Bootstrap Exposes Finalizationregistry Timeout Bypass
Sandbox-global bootstrap hardens platform intrinsics by reflectively removing well-known globals (Reflect.deleteProperty or a local alias of it such as localReflectDeleteProperty, or the delete operator) — timers, microtasks, eval/Function, WebAssembly.instantiateStreaming, process/require, console, SharedArrayBuffer/Atomics, ... — but does not remove Finali
JSgreprules fetch cve-2026-92942-js-sandbox-bootstrap-exposes-finalizationregistry-timeout-bypass --engine opengrepDescription
Sandbox-global bootstrap hardens platform intrinsics by reflectively removing well-known globals (Reflect.deleteProperty or a local alias of it such as localReflectDeleteProperty, or the delete operator) — timers, microtasks, eval/Function, WebAssembly.instantiateStreaming, process/require, console, SharedArrayBuffer/Atomics, ... — but does not remove Finali
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.