Live › vulnerability › CVE-2026-119332
Ladybird's JavaScript engine frees a finalization record while it is still referenced during cleanup, so the next cleanup reads freed memory. A malicious web page can use this to crash the browser and corrupt its memory, which can lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Anyone running a Ladybird build older than the fixing commit who visits untrusted web pages. The flaw sits in the browser's JavaScript engine (LibJS), so exposure comes from browsing, not from a server configuration. Users of other browsers are not affected by this flaw.
No product ranges from the sources yet.
209579c96473c75bd5eba9701fcadb841a045964.209579c96473c75bd5eba9701fcadb841a045964; the sources do not give a release version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.
This page as .md · .json · in your agent: get_signal("CVE-2026-119332")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.