Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…dybird/security/advisories/GHSA-6cmv-xmff-qjph Diğer
• github.com/…ommit/209579c96473c75bd5eba9701fcadb841a045964 Diğer

Kayıt geçmişi

1. 30 Eki 2026 22:57Yayımlandı

İlgili açıklar

• 7,1 CVE-2026-119331Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation
• 6,9 CVE-2026-119338Tesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages
• 7,8 CVE-2026-119116Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
• 5,5 CVE-2026-119378SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
• 5,5 CVE-2026-119372SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
• 8,8 CVE-2026-119271Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code in…