EIP-2026-103990

This exploit leverages a cross-domain security violation in browsers by using `window.open` with a `view-source` URI to bypass same-origin policy, potentially allowing arbitrary script execution in the local security zone. The PoC demonstrates this by opening a new window and injecting content after a delay.