The problem was in lxml
https://bugs.launchpad.net/lxml/+bug/1742885
which calibre uses to parse EPUB files. It allows injection of arbitrary file content into the parsed EPUB. The parsed EPUB in turn can have javascript which is run in the viewer (in a sandbox), and that javascript can access the parsed content despite being sandoxed because it is part of the parsed book contents.