CVE-2026-119332 Details
Description
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.
A heap use-after-free vulnerability has been identified in Ladybird Browser's JavaScript engine, specifically within the FinalizationRegistry cleanup process. This issue arises because the cleanup function can be manipulated to execute arbitrary JavaScript, potentially leading to memory corruption. The vulnerability is present in all versions through May 2026, except for the latest commit which addresses the issue.
Users should update to the latest version of Ladybird Browser, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964 | [email protected] | Source CodeVendor |
| https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ladybird | <= 8121ff82 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |