Ladybird Browser CVE-2026-119331

Exploitation requires the victim to load an attacker-controlled page in a vulnerable Ladybird build (UI:R), and that page must reference a cross-origin stylesheet that is fetched WITHOUT CORS (a plain <link> or @import), so it is correctly marked non-origin-clean - the exact precondition that should have triggered a SecurityError. No authentication, no opt-in flags, and no non-default configuration are needed; the advisory confirms no user interaction beyond page load. Limiting factors: the attacker only obtains the parsed rule text of sheets it can cause to be loaded (so value depends on those sheets containing secrets), the impact is confined to the attacker page's lifetime with no persistence, and the affected population is limited to Ladybird builds up to the fixed commit - a small, pre-release user base. Same-origin stylesheets and CORS-same-origin sheets remain correctly accessible and are not a vector.

This is a genuine but bounded Same-Origin-Policy bypass, not a high-CVSS inflation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N = 7.1) is internally consistent with the mechanism: remote, low-complexity, no privileges, but requiring the victim to load an attacker-controlled page (UI:R). The source diff and GHSA advisory both confirm the root cause - the origin-clean flag is correctly set on cross-origin imported stylesheets but is never read in cssRules, insertRule(), or deleteRule(), so the mandated SecurityError is never thrown. A confirmed, reproduced live PoC is documented in the advisory (dual-origin reproducer plus screen recording and evidence log), which materially raises practical risk over a theory-only report. No EPSS score and no CISA KEV status were supplied; absence of KEV is not evidence of absence of exploitation, but nothing in the input indicates active in-the-wild use. The vuln.today decision label is 'this_week' (not act_now/emergency). The dominant risk-limiting factor is deployment footprint rather than exploit difficulty: Ladybird is a pre-release independent browser with a negligible production base, so widespread opportunistic exploitation is unlikely despite the easy, reliable primitive. The input Tags ('RCE', 'Buffer Overflow') directly contradict the description, which explicitly rules out memory corruption, code execution, and persistence - treat those tags as erroneous. Confidentiality is scored High, which is defensible when the targeted cross-origin CSS embeds secrets (tokens, user-specific class names, feature-flag/A-B markers); for stylesheets with no sensitive rule text the real-world confidentiality impact is lower.

A victim using Ladybird visits an attacker-controlled page that references a cross-origin stylesheet (e.g. a CDN-hosted CSS framework, icon set, or a target site's own sheet loaded via a plain <link> without CORS). The attacker's JavaScript then reads sheet.cssRules to exfiltrate parsed rule text - potentially exposing secret selectors or content: values such as the advisory's TOP_SECRET_CSS_MARKER - and calls insertRule()/deleteRule() to alter layout or inject phishing overlays, all without the SecurityError browsers like Chrome and Firefox throw. A working public PoC reproducing all three operations is included in the GHSA advisory and an evidence archive.