EUVD lists Ladybird origin-clean enforcement flaw in CSSStyleSheet (EUVD-2026-114394)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Ladybird
- Product
- Ladybird
- First seen
Summary
The EUVD entry, as relayed on Mastodon, says Ladybird's CSSStyleSheet.cssRules, insertRule() and deleteRule() did not enforce the stylesheet origin-clean check before a fixing commit. It gives a CVSS v3.1 score of 7.1/10.
If you use Ladybird
Update Ladybird to a build that includes the fix referenced in EUVD-2026-114394
Avoid browsing untrusted sites with Ladybird builds that predate the fix
Update Ladybird to a build that includes the fix referenced in EUVD-2026-114396
What the sources say 2
· Mastodon: “Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the n” Source
· Mastodon: “Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean” Source