Loading story…
A high-severity vulnerability tracked as CVE-2026-58592 allows a malicious web page to achieve code execution in the Ladybird browser's WebContent process by exploiting a memory-safety flaw in WebAssembly ECMAScript Module integration. The bug occurs when a JavaScript function is imported into a WebAssembly module through the ESM path and a stack-local Wasm::FunctionType is passed by reference to a host callback, which later dereferences it after destruction. The stale type data can cause the callback to return an empty result vector where a non-empty result is expected, leaving an attacker-controlled value in a destination register that is later consumed by the WASM-GC array.set handler and turned into an arbitrary write primitive.
A public proof of concept shows the flaw can be chained with a separate memory disclosure issue involving ImageData, WebGL, and memory64 backing-store movement to leak heap and library addresses, recover liblagom-wasm and libc base addresses, and build native read/write access. The exploit reportedly retargets a DataView backing store, forges a virtual dispatch target and setcontext frame, and executes the Linux marker command below, demonstrating remote code execution from HTML content without instrumentation or source changes.
touch /tmp/ladybird_wasm_esm_rce
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub proof-of-concept exploit was published showing remote code execution against Ladybird's WebContent process by chaining the WebAssembly ESM host-function lifetime bug with a separate memory disclosure primitive. The PoC demonstrates native read/write and executes the marker command `touch /tmp/ladybird_wasm_esm_rce` on Linux.
A high-severity memory-safety flaw in Ladybird's WebAssembly ESM integration was published as CVE-2026-58592. The issue can be triggered from malicious HTML content and can lead to code execution in the browser's WebContent process.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two Chrome renderer exploitation chains that turned memory-corruption flaws into remote code execution from malicious web content. One write-up analyzed `CVE-2020-15972`, a use-after-free in Chrome's WebAudio component on Android, where removal of a mutex during orphaned `AudioHandler` cleanup let the audio processing thread access freed memory. The bug could be triggered through `AudioWorkletNode` and `ScriptProcessorNode`, enabling an out-of-bounds read for information disclosure, ASLR bypass, and eventual control of a virtual function call inside the renderer. A separate analysis showed how the `libwebp` bug's limited 4-byte out-of-bounds write in Chrome Blink could be weaponized into full renderer RCE by abusing Chromium heap behavior. The researchers used `CSSVariableData` and PartitionAlloc ThreadCache placement to convert the write into a use-after-free, reclaimed the freed object with `AudioArray` to gain a heap out-of-bounds read, and then forged an `HRTFPanner` object to execute attacker-controlled code on Chromium running Ubuntu 22.04. Together, the reports show how attackers can chain information disclosure, allocator manipulation, and object corruption inside the Chrome renderer, while Google had already patched the WebAudio flaw in Chrome `86.0.4240.75`.
Aug 24, 2026
A critical vulnerability, tracked as CVE-2025-13016, was discovered in the WebAssembly engine's JavaScript component of Mozilla Firefox and Thunderbird, exposing over 180 million users to the risk of arbitrary code execution. The flaw, introduced in April 2025, results from incorrect boundary conditions in pointer arithmetic within the garbage collection process, leading to a stack buffer overflow. Attackers can exploit this vulnerability by luring users to malicious websites or sending crafted email content, potentially gaining complete control over the affected browser or mail client process. The vulnerability affects Firefox versions below 145 and Thunderbird versions prior to 145, including their respective ESR releases. Mozilla responded promptly by releasing security patches in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird ESR 140.5. Security experts and vendors have emphasized the importance of immediate updates to mitigate the risk, as the flaw remained undetected for six months and could have compromised sensitive user data. Organizations and individuals are strongly advised to deploy the latest updates to ensure protection against potential exploitation of this high-severity vulnerability.
Jun 29, 2026
Exodus Intelligence disclosed **CVE-2026-3542**, a Chrome vulnerability in V8’s AsmJS-to-WebAssembly pipeline that allowed attackers to break out of the **Ubercage** sandbox and achieve arbitrary code execution. The flaw stemmed from shared parser state used to track heap-access shift operations: nested shift expressions could overwrite truncation metadata, causing V8 to generate a stale, misaligned WebAssembly opcode stream. Because AsmJS-generated opcodes were treated as trusted, the malformed stream bypassed normal WebAssembly validation and enabled execution of unintended opcodes. The write-up shows how the bug could be turned into arbitrary read/write by abusing missing validation on cross-module type access for struct opcodes, leaking the trusted cage base through `WasmTrustedInstanceData`, and overwriting a WebAssembly jump table to seize control of execution. The research echoes earlier browser JIT exploitation work such as Google Project Zero’s analysis of **CVE-2020-9802** in WebKit JavaScriptCore, where compiler optimization errors also produced out-of-bounds access and exploit primitives despite modern mitigations. Google patched **CVE-2026-3542** in Chrome on 3 March 2026.
Jul 12, 2026