Ladybird: Use-after-free in FinalizationRegistry via reentrant unregister()
Summary
The JavaScript engine LibJS of the Ladybird browser contains a use-after-free in FinalizationRegistry::cleanup(). A malicious web page can trigger it when a cleanup callback calls unregister() for a record that the running cleanup loop still references. The result is a crash of the renderer process or heap memory corruption, which the advisory describes as a possible primitive for further exploitation. The CVSS score is 8.8 (High), and the attack requires a user to visit a malicious page with an affected build.
Affected
- Ladybird builds prior to commit 209579c96473c75bd5eba9701fcadb841a045964
Fixed in
- Fixed by commit 209579c96473c75bd5eba9701fcadb841a045964
- Fixed release version: Unknown.
Workaround
- Unknown. No vendor workaround was found.
- Avoid affected builds and do not browse untrusted sites with them until a fixed build is in use.
Exploitation
- No evidence of in-the-wild exploitation was found, and the CVE is not listed in CISA KEV.
- No public exploit was found in the reviewed sources. The advisory's technical description is public.
Our recommendation
- Check endpoints for Ladybird binaries. Remove them or restrict them to isolated test machines until a fixed build is confirmed.
- Do not browse untrusted sites with affected builds.
- Monitor the advisory for the patched release version and update as soon as one is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 209579c github.com
- GitHub Security Advisory GHSA-6cmv-xmff-qjph github.com
- VulDB entry vuldb.com
- Positive Technologies PT-2026-134169 vulners.com
- OffSeq Radar threat entry radar.offseq.com
- Strix CVE entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:40.
Original description (NVD)
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.