Read the docs
TI-2026-83371 Aliases CVE-2026-119332

Use-after-free in Ladybird FinalizationRegistry cleanup

Priority HIGH 73CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Ladybird builds before commit 209579c96473c75bd5eba9701fcadb841a045964 contain a use-after-free in FinalizationRegistry::cleanup() (CWE-416). A cleanup callback that calls unregister() on the next record frees a node that the cleanup loop still references, and the loop then reads its fields. An remote attacker needs no privileges, but the user must interact with the attacker's page to trigger it. The flaw reliably crashes instrumented WebContent builds and gives an attacker a memory-corruption primitive in production builds.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed ladybird (LadybirdBrowser): 209579c96473c75bd5eba9701fcadb841a045964

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LadybirdBrowserladybirdbefore 209579c96473c75bd5eba9701fcadb841a045964209579c96473c75bd5eba9701fcadb841a045964Patch availableCNA
  • ladybird VendorLadybirdBrowser Affected before 209579c96473c75bd5eba9701fcadb841a045964 Fixed in 209579c96473c75bd5eba9701fcadb841a045964 Patch available CNA

Remediation

The fix is commit 209579c96473c75bd5eba9701fcadb841a045964, so builds from that commit onward are not affected. Update Ladybird to a build that includes this commit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ladybird (LadybirdBrowser) Fixed in 209579c96473c75bd5eba9701fcadb841a045964

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119332
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-06 CISA SSVC decision points changed
  4. 2026-11-06 Priority changed: LOW → HIGH

References

Other 2

  • TI-2026-42172 Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration CVSS 4.0HIGH 8.9
  • TI-2026-83370 Missing origin-clean checks in Ladybird CSSStyleSheet CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences