LadybirdBrowser's WebAssembly ESM-integration module loader contains a dangling-reference flaw where a stack-local Wasm::FunctionType is passed by reference to create_host_function. The host callback captures this reference, but after the ESM link-loop iteration ends, the FunctionType is destroyed, leaving a dangling reference. This stale reference causes the host callback to return an empty result vector for a statically non-empty result, allowing the destination register to retain an attacker-influenced value. This value is then used by the WASM-GC array.set handler, which performs a bit-cast after only a null check, enabling an arbitrary write primitive. A malicious web page can exploit this to achieve code execution within the WebContent process. The vulnerability is reachable from HTML content without instrumentation or source modification. The CVSS v3.1 score is 8.3, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity. No patch or vendor advisory is currently available.

Successful exploitation allows an attacker-controlled web page to achieve arbitrary memory writes in the WebContent process, leading to potential remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The attack requires user interaction but can be triggered remotely over the network. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, users should exercise caution when visiting untrusted web pages and consider limiting exposure to potentially malicious content.