CVE-2026-119331 Details
Description
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.
A vulnerability in Ladybird Browser allows cross-origin stylesheets to be read and modified without proper security checks. Prior to the patch in commit c0d68bddf3e3616e5173835f0f4c155ee9700d91, the browser's CSSOM implementation did not enforce origin-clean restrictions on key stylesheet manipulation methods and properties. This oversight enabled malicious pages to access, alter, and delete CSS rules from stylesheets loaded without CORS, effectively bypassing the Same-Origin Policy. The vulnerability could be exploited to read sensitive CSS information or disrupt page layout and visibility.
Users should update to the latest version of Ladybird Browser, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LadybirdBrowser/ladybird/commit/c0d68bddf3e3616e5173835f0f4c155ee9700d91 | [email protected] | Source CodeVendor |
| https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-xj66-c4cw-xwh3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ladybird | <= 7e8da6e7cf24 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |