EIP-2026-103709

The writeup describes a WebKit vulnerability (EIP-2026-103707) where a race condition during page navigation allows JavaScript execution in the context of another document. The attack requires a victim page to load an attacker-controlled iframe and exploits the `detachChildren` function to bypass `SubframeLoadingDisabler`.