Summary by JayTaelien
attacker supplies a Wistia iframe URL anywhere a link can be embedded
-> Wistia's plugin parameter loads attacker-controlled HTTPS JavaScript that can take over the visible content
-> victim clicks once inside the visible embed
-> allowlisted Asana authentication wrapper creates an IntegrationWindow
-> the returned window is synchronously retargeted to attacker HTTPS
-> CVE-2026-15776 yields bounded V8 pointer-compression-cage access
-> the primitive recovers Electron sandbox exports and linkedBinding
-> electron_renderer_ipc sends internal BROWSER_SANDBOX_LOAD
-> main-process APPDATA, platform, and architecture are recovered
-> a fixed profiler DLL is hash-verified into the first IndexedDB Blob
-> set-desktop-settings('__proto__', fixed COR_* values) (prototype pollution)
-> Object.assign copies those values onto main-process Object.prototype
-> download-update-and-restart enters Electron's Squirrel updater
-> Node child_process includes inherited enumerable environment values
-> signed Update.exe starts with the four fixed CLR profiler variables
-> CLR loads the fixed x64 profiler from the browser-owned Blob file
-> the profiler opens .exe success
-> COR_* values are reset to undefined, a full Asana exit clears the keys