Core found something, but it wasn’t a sandboxing security hole

the point is, it should have been sandboxed! What's a sandboxing security hole if that isn't one?