Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation
Affects Ladybird builds through commit 7e8da6e7cf24 on master (Oct 2026) when a page loads a cross-origin stylesheet without CORS headers. No vendor rating or fixed version is listed.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Ladybird, an independent open-source web browser, is affected by a flaw in how it handles CSS stylesheets from other sites. A malicious web page could read the rules of a cross-origin stylesheet and insert or delete rules in it, which could expose sensitive style information or change how the victim page looks and is laid out.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- LadybirdBrowser ladybird
Version range not reported
References 2
GitHub · LadybirdBrowser/ladybird
Questions about CVE-2026-119331
What does this mean?
Ladybird does not enforce origin-clean rules on CSSStyleSheet, which lets page script read and modify a cross-origin stylesheet that was loaded without CORS headers.Source: github.com
Am I affected, and how do I check?
Builds through commit 7e8da6e7cf24 on master (Oct 2026) are listed, and the condition is a page loading a cross-origin stylesheet without CORS headers. A reader can check a build's commit against 7e8da6e7cf24.Source: github.com
What should I do about it?
The checked facts name no fixed release or commit, so no upgrade target can be given.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts give no workaround or interim mitigation, so none can be stated from them.Source: github.com