The confused-deputy attack from demo.js, running the real engine in your browser.
The browser core disagreed with the Node core this page claims to be. Rather than render a demo that would be lying about what it runs, here is the divergence:
what the helper was handed
which step decided
what actually left