LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attackers to execute arbitrary code via a crafted .js file. NOTE: the GitHub README says "Ladybird is in a pre-alpha state, and only suitable for use by developers."
The bug consists of improper lifecycle management of a vector storing the arguments list (arguments_list) in the LibJS JavaScript engine. Memory allocated for this vector is freed prematurely and subsequently used by the engine (use-after-free, CWE-820). An attacker can provide a victim with a crafted .js file whose processing by Ladybird triggers this bug and enables control over execution flow.
Successful exploitation of the vulnerability allows a remote attacker to execute arbitrary code (RCE) in the context of the browser process, which may lead to complete compromise of system confidentiality, integrity, and availability.
Ladybird should be updated to a version containing commit f5a670421954fc7130c3685b713c621b29516669 or newer. It is worth noting that according to the official Ladybird project README, Ladybird is pre-alpha software intended solely for developers — it should not be used in production environments or by end users.
Ladybird versions prior to commit f5a6704 (f5a670421954fc7130c3685b713c621b29516669); affects the LibJS component built into this browser
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H