A LibJS JavaScript engine used in the Ladybird web browser has a vulnerability (CVE-2025-47154) that allows execution of arbitrary code in the system when processing specially crafted JavaScript code. The vulnerability is caused by the freeing of memory in the m_argument_values_buffer vector, which still had a pointer in the arguments_list structure, leading to access of an already freed memory area. A working exploit prototype is available.
The researcher who discovered the issue conducted fuzzing testing on LibJS, during which 10 crashes were recorded. Analysis of one of the crashes showed that the problem could be exploited while processing JavaScript code. The vulnerability allowed reading and writing to arbitrary memory areas of the process. Code execution was carried out in the exploit by replacing the return pointer from the rendering function. With the help of return-oriented programming (ROP), a chain was formed to execute the execve system call to launch an external application.
The Ladybird browser is developed by Andreas Kling, who once worked at Nokia on KHTML and later became one of the developers of Safari at Apple. At its current stage of development, Ladybird is in pre-alpha, suitable only for use by developers. The project was initially created as an application for the SerenityOS operating system but was separated last summer into an independent project and received a donation of $1 million. The browser is written in C++ (planned to switch to Swift) and is distributed under the BSD license. The project develops its own LibWeb engine, LibJS JavaScript interpreter, and associated libraries.
Forrás: opennet.ru
