CVE-2026-40369: Twelve Bytes to Escape the Browser Sandbox