JavaScript sandboxes are widely used to isolate untrusted code execution. However, isolation guarantees can become fragile when objects cross execution realms and reference sharing occurs between host and sandbox environments. In this research, I explore how cross-realm reference propagation can affect the isolation model of JavaScript sandboxes and how subtle object identity relationships may weaken expected security boundaries. The article covers: • Theoretical background on JavaScript realms and sandbox isolation• How reference sharing can occur between host and sandbox contexts• Experimental analysis across different sandbox implementations• Technical observations on identity propagation, prototype mutation, and capability leakage• Security implications for sandbox-based architectures• Practical recommendations for safer sandbox design The goal of this work is not only to document these behaviors but also to encourage stronger isolation models and safer sandboxing patterns in modern JavaScript runtimes. For anyone working with JavaScript security, sandbox environments, runtime isolation, or secure execution of untrusted code, I hope this research provides useful insights.
Franciny Salles Rojas Marin (Wed,) studied this question.