EIP-2026-104487

This PoC exploits a race condition in FrameLoader::open where JavaScript handlers fire during frame destruction, leading to potential UXSS (Universal Cross-Site Scripting). The attack chain involves navigating frames, triggering unload events, and manipulating document states to bypass same-origin policy.