Read the docs
TI-2026-83370 Aliases CVE-2026-119331

Missing origin-clean checks in Ladybird CSSStyleSheet

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-346.

Summary

Ladybird builds prior to commit c0d68bddf3e3616e5173835f0f4c155ee9700d91 are affected. The cssRules getter and the insertRule() and deleteRule() methods of CSSStyleSheet do not enforce the origin-clean flag, which is an origin validation error (CWE-346). A malicious page that a user visits can read parsed rules from a stylesheet loaded without CORS and can insert or delete rules in a victim stylesheet, bypassing the Same-Origin Policy. Reading can expose selectors and other sensitive rule text, and mutation can alter page visibility or layout.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LadybirdBrowserladybird< c0d68bddf3e3616e5173835f0f4c155ee9700d91—No fix listedCNA
  • ladybird VendorLadybirdBrowser Affected < c0d68bddf3e3616e5173835f0f4c155ee9700d91 Fixed in — No fix listed CNA

Remediation

The fix is commit c0d68bddf3e3616e5173835f0f4c155ee9700d91, and the sources list no fixed version for Ladybird.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119331
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2026-42172 Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration CVSS 4.0HIGH 8.9
  • TI-2026-83371 Use-after-free in Ladybird FinalizationRegistry cleanup CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences