# Host realm object leak across sandbox

Sandboxed code receiving live host objects, promises or globals that were never sealed or bridged

_Area: Memory corruption and native code. Seen in 4 disclosed reports; latest 2026-10-05. Updated 2026-10-23._

## How it works
A sandbox is only as strong as the boundary between its realm and the host's. That boundary assumes every host object handed to sandboxed code is either a sealed copy or a bridge proxy that mediates all access. The leak happens when some path returns the *original* host object instead: a sanitizer that rebuilds a carrier but forgets to seal the original, an engine fast path that skips a monkey-patched wrapper, an intrinsic that returns a raw host Promise, or a process-global singleton reachable through an allowlisted module. Once sandboxed code holds a live host object, it can walk its constructor chain back to host `Function`/`process` and escape.

## Where it shows up
- Sanitizers that snapshot-rebuild objects (e.g. AggregateError) instead of sealing in place, combined with cycle/duplicate short-circuits that return the raw carrier [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x965-fc75-jpqh.md)
- Monkey-patched intrinsics (`Promise.prototype.then`/`catch`) where engine protectors or fast paths can bypass the wrapper [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-27g9-p43v-cw3v.md)
- Intrinsics returning raw host-realm Promises not routed through the bridge (streaming WebAssembly, dynamic import) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjwh-qqvp-g4p4.md)
- Allowlisted modules exposing process-global singletons (`https.globalAgent`, shared pools, caches) whose EventEmitter methods mutate real host state [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md)
- Read-only proxies used as the only defense for objects with mutating methods

## How to review
For every host object crossing into the sandbox, verify the invariant: sandboxed code only ever holds a sealed copy or a bridge proxy, never the live host object. Check that cycle-detection short-circuits cannot return an unsealed original; that every intrinsic returning a Promise is bridged; that engine fast paths cannot skip wrappers (test on newest V8); and that allowlisted modules expose no mutable process-global singletons. Enumerate all intrinsics returning Promises or host objects, not just the ones a prior fix touched.

## Variants seen
- Rebuild-without-seal plus cycle short-circuit returning raw carrier [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x965-fc75-jpqh.md)
- Engine protector bypassing monkey-patched Promise wrappers [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-27g9-p43v-cw3v.md)
- Unbridged host-realm Promise from streaming WebAssembly with species-controlled rejection [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjwh-qqvp-g4p4.md)
- Global EventEmitter singleton leaking live sockets and credentials [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md)

## Why fixes fail
Fixes that seal one carrier shape leave sibling shapes open [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x965-fc75-jpqh.md); removing specific intrinsics leaves other Promise-returning intrinsics exposed [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjwh-qqvp-g4p4.md); wrappers are bypassed by engine fast paths on new runtimes [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-27g9-p43v-cw3v.md).

## Impact and severity
All four led to sandbox escape: host RCE [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-x965-fc75-jpqh.md), host Function/process access [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-27g9-p43v-cw3v.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjwh-qqvp-g4p4.md), and theft of host bearer tokens plus plaintext TLS traffic [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md). Severity is critical; worse when the leaked object is a live singleton or a constructor-walkable host function.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-x965-fc75-jpqh.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-27g9-p43v-cw3v.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-wjwh-qqvp-g4p4.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-h85j-hv3c-qfgq.md