Ladybird Browser CVE-2026-119332

Exploitation requires the victim to load attacker-controlled JavaScript in Ladybird's WebContent process and for the page to drive the FinalizationRegistry cleanup path: register at least two objects (the second with an unregister token), make them unreachable, trigger cleanup (via cleanupSome() or GC pressure), and have the first record's cleanup callback call registry.unregister(token) on the second record so remove_by_token() frees the node the retained iterator points to. No authentication is required (PR:N) and it works against default configurations - any webpage can trigger it - but it does require user interaction in the form of visiting the malicious page (UI:R). Limiting factors: reliable deterministic crash is demonstrated on ASAN/instrumented builds; turning the UAF into a controlled type-confusion/RCE in production builds additionally requires a successful same-size (32-byte) heap spray during the callback window and a separate information leak to defeat ASLR, which is not included in the provided data.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) is consistent with the mechanism: a remote, unauthenticated attacker triggers an attacker-reachable heap use-after-free in the LibJS FinalizationRegistry simply by getting a victim to visit a web page (UI:R). The SSVC/priority signal from vuln.today is 'this_week' (not act_now/emergency), which aligns with the absence of a CISA KEV listing and no observed active exploitation. A detailed, reproduced PoC is published in the GHSA advisory (GHSA-6cmv-xmff-qjph), including ASAN output and both a command-line and browser trigger, so exploitability of the crash is confirmed even though weaponized RCE additionally requires a heap spray and an ASLR-defeating information leak. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be compared. The main caveat is a patch-status conflict: the description and advisory state the flaw is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964, while the package metadata line says 'not yet patched (All versions through commit 8121ff82)' - verify the fix has actually landed in a consumable build before closing out. Net: a reliable remote-triggerable memory-corruption primitive in a browser engine warrants prompt patching, tempered only by the product's very small real-world footprint.

An attacker hosts a malicious web page containing JavaScript that registers two objects in a FinalizationRegistry, forces them to become garbage, and triggers cleanup; the cleanup callback for the first dead record calls unregister() on the second record's token, freeing the node the engine's saved iterator still points to. On the next loop iteration the WebContent process reads target and held_value from freed memory, reliably crashing instrumented builds and, after a same-sized heap spray (e.g. Uint32Array), handing the attacker control of the held_value JS::Value for a type-confusion primitive. A full working PoC (ASAN-confirmed, exit 134) is published in the GitHub Security Advisory, and the attack needs only that the victim visit the page (UI:R).