CVE-2026-58592: Ladybird WebAssembly ESM Dangling-Reference Code Execution

Technical summary

CVE-2026-58592 is a use-after-free vulnerability arising from a stack-local lifetime mismatch in Ladybird's WebAssemblyModule.cpp. During ESM-integration module loading, when JavaScript functions are imported into WebAssembly, the codebase passes a stack-allocated Wasm::FunctionType reference to create_host_function. The host callback captures this reference and relies on it later, but the FunctionType object is destroyed when the ESM link-loop iteration completes, leaving the callback with a dangling pointer. When the callback is invoked, it reads stale result-type metadata and returns an empty result vector despite the function signature declaring non-empty returns. This causes the destination register to retain an attacker-controlled value. The WASM-GC array.set instruction then interprets this value as an ArrayInstance pointer after only null-checking the low bits, enabling arbitrary memory write. The standard instantiate path is unaffected because it maintains a longer-lived reference. The attack surface is reachable from any HTML content loaded in the browser without requiring source modification or special instrumentation.

Business impact

This vulnerability permits remote code execution within a browser's WebContent process via a malicious or compromised web page. An attacker can execute arbitrary code with the privileges and context of the browser content process, potentially enabling credential theft, session hijacking, malware installation, or lateral movement within a user's system. Since Ladybird is an emerging open-source browser project, the blast radius depends on adoption; however, any deployment in security-sensitive environments or as a primary browser represents a significant risk. The requirement for user interaction (visiting a malicious site) moderates the threat slightly but does not eliminate it, as social engineering and drive-by downloads remain practical attack vectors.

Affected systems

Ladybird browser engine versions are affected. The source data does not specify exact version boundaries; organizations using Ladybird should verify which versions are vulnerable against the vendor's advisory and patch releases. The vulnerability is present in the ESM-integration code path, so it affects any Ladybird build that includes WebAssembly ESM support.

Exploitability

The vulnerability is moderately difficult to exploit reliably in practice, reflected in the CVSS score's high complexity rating (AC:H). An attacker must craft JavaScript and WebAssembly payloads that reliably trigger the timing and memory-layout conditions necessary for the dangling reference to be read at the correct moment and for the bit-cast of the corrupted value to form a valid-looking ArrayInstance pointer. However, the flaw is not speculative or probabilistic—it is a deterministic memory-safety error that can be reproduced. No advanced exploit techniques such as JIT side-channels or Spectre-class mechanisms are required. The requirement for user interaction (UI:R) means the attack must be delivered via a web page a user chooses to visit, ruling out passive network attacks but not social engineering.

Remediation

Fix the lifetime issue by ensuring the Wasm::FunctionType object persists for the entire duration during which the host callback might be invoked. This typically involves either allocating the FunctionType on the heap with appropriate lifetime management (shared_ptr or similar), or restructuring the ESM loader to avoid capturing references to stack-local objects. Verify against the vendor advisory for the exact patched version and apply it immediately to all Ladybird deployments. Until patched, restrict Ladybird to trusted environments and disable or isolate WebAssembly ESM imports if the browser is used to browse untrusted content.

Patch guidance

Consult the official Ladybird project repository and security advisories for patch version numbers and availability. Apply any released patches to your Ladybird installation at the earliest opportunity. If you maintain a fork or embedded integration of Ladybird, audit your version to confirm whether the dangling-reference flaw in WebAssemblyModule.cpp is present, and backport or cherry-pick the upstream fix. Test patch deployments in a controlled environment to ensure compatibility with your workflow before rolling out to production.

Detection guidance

Monitor process logs and crash reports for WebContent process crashes correlated with WebAssembly module loading or ESM imports, which may indicate exploitation attempts. Use browser security event logging (if available) to track failed or suspicious module loads. At the network level, identify and block known malicious payload domains. On the host, monitor for unexpected child processes spawned from the browser or unusual memory access patterns during WebAssembly execution. Endpoint detection and response (EDR) tools should flag code execution originating from Ladybird's WebContent process, particularly if it coincides with WebAssembly operations.

Why prioritize this

Despite not yet being listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability merits high priority due to its combination of a complete attack chain (code execution), high CVSS score (8.3), and reachability from any web page without user-side instrumentation. The dangling-reference flaw is a deterministic memory-safety error, not a speculative one, making it likely to be exploited once public. Organizations using Ladybird should treat this as a critical security update. Even those not currently using Ladybird should note this as an example of memory-safety flaws that can arise in browser engines, particularly in complex subsystems like WebAssembly-ESM integration.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: high impact (confidentiality, integrity, and availability all at high risk due to code execution); low attack complexity (the exploit does not require advanced techniques, though timing conditions are non-trivial); high user interaction required (a user must visit a malicious page); and changed scope (the compromise affects the browser content process and can cascade to the user's system). The absence of authentication or special privileges required keeps the severity in the HIGH range rather than CRITICAL, but the attack surface (any web page) and deterministic nature of the flaw elevate it well above typical high-severity issues.

Frequently asked questions