CVE-2025-43330: breaking out of a sandbox using font files (bsssq.xyz)

I am not the author of this post. The exploration of the scheme based sandbox permissions DSL was interesting to me. It's a classic issue of a custom parser with bad input validation.