vm2: Sandbox Breakout Through Promise Species (CVE-2026-24120) | HOL Guard CVE