{"id":"CVE-2026-119332","kind":"vulnerability","aliases":["CVE-2026-119332"],"related":[],"title":"Ladybird browser: JavaScript cleanup callback frees memory a page can reuse","description":"Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.","summary":"Ladybird's JavaScript engine frees a finalization record while it is still referenced during cleanup, so the next cleanup reads freed memory. A malicious web page can use this to crash the browser and corrupt its memory, which can lead to code execution.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript-engine","ladybird","runtime","web-browser"],"not_affected_if":["other-browsers"],"how_to_check":"- Check whether the Ladybird build includes commit `209579c96473c75bd5eba9701fcadb841a045964`.\n- Confirm the exact Ladybird version in use; the sources do not name a release version.","fix":"- Ladybird builds that include commit `209579c96473c75bd5eba9701fcadb841a045964`; the sources do not give a release version.","status":"open","published_at":"2026-10-30T20:17:07+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","triaged_at":"2026-10-30T20:26:16+00:00","updated_at":"2026-10-30T20:26:16+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-30T20:26:16Z","model":"claude-haiku-5-5","output":{"fix":"- Ladybird builds that include commit `209579c96473c75bd5eba9701fcadb841a045964`; the sources do not give a release version.","reach":"internet","title":"Ladybird browser: JavaScript cleanup callback frees memory a page can reuse","impact":"high","summary":"Ladybird's JavaScript engine frees a finalization record while it is still referenced during cleanup, so the next cleanup reads freed memory. A malicious web page can use this to crash the browser and corrupt its memory, which can lead to code execution.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["ladybird","web-browser","javascript-engine"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"A malicious page corrupts browser memory and may run code","analyst_note":"","how_to_check":"- Check whether the Ladybird build includes commit `209579c96473c75bd5eba9701fcadb841a045964`.\n- Confirm the exact Ladybird version in use; the sources do not name a release version.","plain_action":"Update Ladybird to a build that includes commit 209579c96473c75bd5eba9701fcadb841a045964.","needs_analyst":false,"not_affected_if":["other-browsers"],"who_is_affected":"Anyone running a Ladybird build older than the fixing commit who visits untrusted web pages. The flaw sits in the browser's JavaScript engine (LibJS), so exposure comes from browsing, not from a server configuration. Users of other browsers are not affected by this flaw.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001189,"input_tokens":4273,"output_tokens":1523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119332':14A,17A '-2026':13A,16A '209579c96473c75bd5eba9701fcadb841a045964':78C,164C 'attack':101C 'attacker-control':100C 'browser':2A,25B,58B,75C 'build':147C,157C 'call':111C 'callback':5A,107C,110C 'cleanup':4A,40B,44B,80C,106C,131C 'code':67B 'commit':163C 'control':102C 'corrupt':60B,153C 'crash':56B,144C 'creat':149C 'cve':12A,15A 'dead':85C 'engin':20B,29B 'execut':68B 'field':139C 'final':32B 'finalizationrecord':96C 'finalizationregistri':79C 'fix':161C 'free':6A,30B,141C 'freed':46B,120C 'held':137C 'independ':73C 'instrument':145C 'invok':99C 'iter':92C,127C,132C 'javascript':3A,19B,28B,103C 'javascript-engin':18B 'ladybird':1A,21B,26B,69C 'lead':65B 'libraries/libjs/runtime/finalizationregistry.cpp':82C 'm':88C 'malici':49B 'memori':7A,47B,62B,152C 'memory-corrupt':151C 'next':43B,95C,115C,130C 'node':122C 'page':9A,51B 'primit':154C 'prior':76C 'product':156C 'read':45B,133C 'record':33B,86C,89C,116C 'referenc':38B,123C 'reliabl':143C 'remov':83C,117C 'retain':90C,126C 'reus':11A 'runtim':22B 'still':37B 'target':135C 'token':119C 'truli':72C 'unregist':112C 'use':53B 'valu':138C 'vulner':159C 'web':24B,50B,74C 'web-brows':23B 'webcont':146C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Ladybird build older than the fixing commit who visits untrusted web pages. The flaw sits in the browser's JavaScript engine (LibJS), so exposure comes from browsing, not from a server configuration. Users of other browsers are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Ladybird to a build that includes commit 209579c96473c75bd5eba9701fcadb841a045964.","first_public_at":"2026-10-30T20:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119332","severity":null,"published_at":"2026-10-30T20:17:07+00:00","modified_at":"2026-10-30T20:17:07+00:00","first_seen_at":"2026-10-30T20:25:38+00:00","fetched_at":"2026-10-30T20:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}