EIP-2026-103436

This exploit demonstrates a type confusion vulnerability in V8's NodeProperties::InferReceiverMaps, where a JSBoundFunction is incorrectly cast to JSFunction, leading to a fatal error in debug mode. The PoC triggers the issue by feeding a bound function as new.target during optimization.