---
id: CVE-2026-119332
title: >-
  Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant
  unregister()
summary: >-
  Ladybird is a truly independent web browser. Prior to
  209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in
  Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from
  m_records, retained an iterato…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-416
vendor: LadybirdBrowser
product: ladybird
affected:
  - ladybird < 209579c96473c75bd5eba9701fcadb841a045964
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T17:59:51.184931Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:00:51.305Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119332'
references:
  - url: >-
      https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph
    label: >-
      https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph
  - url: >-
      https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964
    label: >-
      https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964
tags:
  - cve.org
  - exploit-available
epss: 0.00242
epssPercentile: 0.15392
ingestedAt: '2026-11-05T16:24:31.432Z'
---

## Overview

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.

## Affected

- `ladybird < 209579c96473c75bd5eba9701fcadb841a045964`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.