The vulnerability stems from improper handling of 'new.target' and frame display parameters during cross-context marshalling. The commit fixes two key issues: 1) In CrossSite.cpp, the original code checked for 'HasExtraArg()' before 'HasNewTarget()', leading to incorrect marshalling of the last parameter as a frame display instead of 'new.target'. This could result in an out-of-bounds write. 2) In Arguments.h, the assertion in GetFrameDisplay() did not validate the absence of 'new.target', allowing invalid memory access. Both functions directly contributed to the memory corruption vulnerability by enabling improper parameter handling.