Executive brief
A memory safety vulnerability exists in the Ladybird web browser's WebAssembly engine. By tricking a user into visiting a malicious website, an attacker can exploit a flaw in how the browser handles WebAssembly modules to gain control over the browser process. This could allow the attacker to steal sensitive data or execute unauthorized commands on the user's computer.
Technical details
A dangling reference vulnerability exists in Ladybird's WebAssembly ESM-integration module loader within WebAssemblyModule.cpp. When a JavaScript function is imported via the ESM path, a stack-local Wasm::FunctionType is passed by reference and captured by a host callback; this reference becomes dangling once the ESM link-loop iteration completes. This leads to type confusion where stale result-type data allows a host callback to return an empty result vector for a statically non-empty result. Consequently, a destination register retains an attacker-controlled value that is consumed by the WASM-GC array.set handler. The handler performs a bit-cast to an ArrayInstance pointer with insufficient validation, enabling an arbitrary write. Attackers can exploit this via a malicious web page to achieve code execution in the WebContent process.
Affected products
- LadybirdBrowser Ladybird commit 31bb4d872d802c78ce23d2f273a300f36e8ef6a0 and earlier
Timeline
- 2026-07-01: disclosed: Vulnerability published and CVE-2026-58592 assigned.
References
- https://github.com/LadybirdBrowser/ladybird/blob/master/Libraries/LibWeb/WebAssembly/WebAssemblyModule.cpp
- https://github.com/bikini/exploitarium/tree/main/ladybird-wasm-esm-host-function-rce-poc
- https://www.vulncheck.com/advisories/ladybird-web-reachable-code-execution-via-dangling-functiontype-reference-in-webassembly-esm-integration