Ladybird CVE-2026-58592

Exploitation requires the victim to load attacker-controlled HTML in Ladybird (UI:A - active user interaction, e.g., visiting a page) and specifically requires the WebAssembly ESM-integration path: a WebAssembly module must import a JavaScript function via ESM so that WebAssemblyModule.cpp routes creation through create_host_function with the stack-local Wasm::FunctionType. The standard WebAssembly.instantiate path does NOT trigger the bug (it uses a long-lived reference), so the ESM import mechanism is a hard prerequisite. Successful escalation also requires the WASM module to declare a statically non-empty result type whose stale/empty runtime result leaves an attacker-influenced value consumed by the WASM-GC array.set handler. No authentication is needed (PR:N), but exploitation is limited by high attack complexity and a present attack requirement (AC:H/AT:P) - indicative of a race/timing window and precise heap layout control - and by Ladybird's small deployment footprint. WebAssembly and WASM-GC support must be enabled (default in affected builds).

Signals are mostly aligned toward genuine severity but tempered by exploitation difficulty and deployment scope. The CVSS 4.0 base score is 8.9 with vector AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H and subsequent-system impact SC:H/SI:H/SA:H - network reach, no privileges, but high attack complexity (AC:H) plus a present attack requirement (AT:P, consistent with the race/timing and precise heap grooming the primitive implies) and required active user interaction (UI:A, victim must visit a page). Publicly available exploit code (VulnCheck PoC) meaningfully raises real-world risk, but the CVE is NOT in CISA KEV and there is no evidence of active exploitation, so this is 'PoC exists' rather than 'exploited in the wild' - those are distinct signals. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. The dominant risk-limiting factor is prevalence: Ladybird is a pre-1.0 experimental browser with a very small production footprint, so mass-exploitation potential is low even though per-target impact (renderer RCE) is high. Priority is real for anyone actually running Ladybird, but the aggregate internet-wide risk is constrained by its niche deployment.

A victim using Ladybird navigates to an attacker-controlled web page that serves a crafted WebAssembly module using ESM integration to import a JavaScript function, triggering the dangling FunctionType reference. The stale result-type data yields an attacker-influenced value that the WASM-GC array.set handler bit-casts into an ArrayInstance pointer, giving an arbitrary write that is chained to code execution in the WebContent process. A public proof-of-concept from VulnCheck (github.com/bikini/exploitarium) demonstrates the chain, and the described AC:H/AT:P profile means the exploit likely relies on precise heap/timing conditions rather than a single deterministic request.