{"id":"CVE-2026-119332","state":"PUBLISHED","title":"Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()","description":"Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.","publishedAt":"2026-10-30T19:57:47.291Z","updatedAt":"2026-10-30T19:57:47.291Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"GitHub_M"},"assigner":"GitHub_M","products":["LadybirdBrowser ladybird"],"affected":[{"vendor":"LadybirdBrowser","product":"ladybird","versions":[{"version":"< 209579c96473c75bd5eba9701fcadb841a045964","status":"affected"}]}],"references":["https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph","https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-30T20:04:06.178Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/119xxx/CVE-2026-119332.json","commit":"7684a5927aa3dceabed8dec00447545f1b10f31f","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-119332","state":"PUBLISHED","datePublished":"2026-10-30T19:57:47.291Z","dateUpdated":"2026-10-30T19:57:47.291Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-10-29T20:44:30.285Z"},"containers":{"cna":{"title":"Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()","descriptions":[{"lang":"en","value":"Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964."}],"affected":[{"vendor":"LadybirdBrowser","product":"ladybird","versions":[{"version":"< 209579c96473c75bd5eba9701fcadb841a045964","status":"affected"}]}],"references":[{"url":"https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph","name":"https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964","name":"https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","description":"CWE-416: Use After Free","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-10-30T19:57:47.291Z"},"source":{"advisory":"GHSA-6cmv-xmff-qjph","discovery":"UNKNOWN"}}}}}