LadybirdBrowser's WebAssembly ESM-integration module loader contains a dangling-reference flaw where a stack-local Wasm::FunctionType is passed by reference to create_host_function. The host callback captures this reference and later reads it after the object is destroyed at the end of the ESM link-loop iteration. This stale reference leads to returning an empty result vector for a statically non-empty result, causing the destination register to retain an attacker-influenced value. This value is then used by the WASM-GC array.set handler, which performs a bit-cast to an ArrayInstance pointer after only a null check, resulting in an arbitrary write vulnerability. A malicious web page can exploit this to achieve code execution in the WebContent process. The vulnerability is confirmed reachable from HTML content without any instrumentation or source modification. No patch or official remediation information is currently available.

Successful exploitation allows an attacker to perform arbitrary memory writes within the WebContent process, leading to potential arbitrary code execution. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability can be triggered remotely via crafted web content, posing a significant risk to users of LadybirdBrowser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when browsing untrusted web content. No vendor-provided mitigation or temporary workaround information is currently available.