An incomplete fix for CVE-2024-36137 leaves "FileHandle.chmod()" and "FileHandle.chown()" in the promises API without the required permission checks, while their callback-based equivalents ("fs.fchmod()", "fs.fchown()") were correctly patched. As a result, code running under "--permission" with restricted "--allow-fs-write" can still use promise-based "FileHandle" methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where "--allow-fs-write" is intentionally restricted.