{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-119332","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-10-29T20:44:30.285Z","datePublished":"2026-10-30T19:57:47.291Z","dateUpdated":"2026-10-30T19:57:47.291Z"},"containers":{"cna":{"title":"Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()","problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","description":"CWE-416: Use After Free","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"name":"https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph","tags":["x_refsource_CONFIRM"],"url":"https://github.com/LadybirdBrowser/ladybird/security/advisories/GHSA-6cmv-xmff-qjph"},{"name":"https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964","tags":["x_refsource_MISC"],"url":"https://github.com/LadybirdBrowser/ladybird/commit/209579c96473c75bd5eba9701fcadb841a045964"}],"affected":[{"vendor":"LadybirdBrowser","product":"ladybird","versions":[{"version":"< 209579c96473c75bd5eba9701fcadb841a045964","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-30T19:57:47.291Z"},"descriptions":[{"lang":"en","value":"Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964."}],"source":{"advisory":"GHSA-6cmv-xmff-qjph","discovery":"UNKNOWN"}}}}