sfop

Segmentation Fault-Oriented Programming SFOP This is the artifacts repository for the Segmentation Fault-Oriented Programming exploitation technique. Artifacts Collection Here we briefly describe the artifacts in this repository. In total, there are eight different artifacts, composed of six PoC...

CVE-2026-119332

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...

CVE-2026-119331

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

CVE-2026-119332 Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...

EUVD-2026-114396

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...

CVE-2026-119332

The Ladybird web browser is vulnerable to a use-after-free vulnerability in Libraries/LibJS/Runtime/FinalizationRegistry.cpp within the FinalizationRegistry::cleanup() function. The issue occurs when the function removes a dead record, retains an iterator to the next record, and executes an attac...

CVE-2026-119332 Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...

CVE-2026-119331

The Ladybird web browser is vulnerable to a Same-Origin Policy bypass due to missing origin-clean flag enforcement. Specifically, the CSSStyleSheet.cssRules, insertRule(), and deleteRule() functions in Libraries/LibWeb/CSS/CSSStyleSheet.cpp failed to trigger a SecurityError when handling cross-or...

CVE-2026-119331 Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

EUVD-2026-114394

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

CVE-2026-119331 Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

PT-2026-134169

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m records, retained an iterator to the next FinalizationRecord, and then invoked...

CVE-2026-119332: LadybirdBrowser ladybird: Ladybird is a truly independent web browser

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from mrecords, retained an iterator to the next FinalizationRecord, and then invoked...

CVE-2026-119331: LadybirdBrowser ladybird: Ladybird is a truly independent web browser

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule, and deleteRule in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though...

CVE-2026-72554

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...

CVE-2026-72554: Improper Access Control

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...

Ladybird LibJS Code Execution

The vulnerability of the npm library for web development, LibJS, in the Ladybird web browser, is related to synchronization errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created JS file...

CVE-2026-58592

Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to...

CVE-2026-58592 Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration

Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to...

CVE-2026-58592

Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. When a JavaScript function is imported into a WebAssembly module via the ESM path, WebAssemblyModule.cpp passes a stack-local Wasm::FunctionType by reference to...