CVE-2026-119332 Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...

CVE-2026-119332

The Ladybird web browser is vulnerable to a use-after-free vulnerability in Libraries/LibJS/Runtime/FinalizationRegistry.cpp within the FinalizationRegistry::cleanup() function. The issue occurs when the function removes a dead record, retains an iterator to the next record, and executes an attac...

CVE-2026-119332: LadybirdBrowser ladybird: Ladybird is a truly independent web browser

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...