CVE-2026-119332

Name of the Vulnerable Software and Affected Versions Ladybird versions prior to 209579c96473c75bd5eba9701fcadb841a045964

Description A memory corruption issue exists in the FinalizationRegistry::cleanup() function within Libraries/LibJS/Runtime/FinalizationRegistry.cpp. The process occurs when a dead record is removed from m records while an iterator to the next FinalizationRecord is retained. If the cleanup callback invokes attacker-controlled JavaScript that calls unregister() for the next record, the remove by token() function frees the node referenced by the iterator. Subsequent cleanup iterations then read the target and held value fields after they have been freed, leading to crashes in instrumented WebContent builds or memory corruption in production builds.

Recommendations Update to version 209579c96473c75bd5eba9701fcadb841a045964.