Bluebird.js — Asynchronous Error Suppression & State Race

Affected Version(s): Bluebird v3.7.2 (Custom build used in Marriott production) Reproducible Browsers: Chrome 123+, Firefox 124+, Edge 123+ Operating System(s): macOS, Windows 11, Linux Description: The implementation of Bluebird’s suppressUnhandledRejections and activeFireEvent logic allows a client-side attacker to silence framework-level crashes resulting from state injection. This facilitates the maintenance of a "split-brain" state where the UI remains active as a high-privileged user despite underlying React hydration failures.

Step-by-step Reproduction:

Navigate to a page managed by Bluebird (e.g., Marriott search results).

Use the console to set Promise.config({ monitoring: true, cancellation: true });.

Force a rejection in an identity-linked promise.

Observe that suppressUnhandledRejections prevents a visible error overlay, allowing the fraudulent UI to persist.

Expected vs. Actual:

Expected: Critical identity mismatches should trigger a hard stop or global error handler.

Actual: Bluebird’s lifecycle management allows the "hijacked" state to be prioritized and the resulting errors to be swallowed as background events.