# ladybird

Published articles for ladybird.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CVE-2026-119332 - Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()

DevFeed: [CVE-2026-119332 - Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()](<https://devfeed.tech/articles/cve-2026-119332-ladybird-finalizationregistry-cleanup-heap-use-after-free-via-reentrant-unregister-109377.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-119332>)

Author: CVEFEED.io; github.com

Published: 2026-10-30T20:17:07Z

Content type: release

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Memory Safety](<https://devfeed.tech/topics/memory-safety.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [browser](<https://devfeed.tech/tags/browser.md>), [cleanup](<https://devfeed.tech/tags/cleanup.md>), [cve-2026-119332](<https://devfeed.tech/tags/cve-2026-119332.md>), [heap](<https://devfeed.tech/tags/heap.md>), [ladybird](<https://devfeed.tech/tags/ladybird.md>), [use-after-free](<https://devfeed.tech/tags/use-after-free.md>)

### AI overview

Before commit 209579c96473c75bd5eba9701fcadb841a045964, Ladybird's FinalizationRegistry cleanup retained an iterator to the next record while running a JavaScript cleanup callback. If the callback unregistered that record, the node was freed; the next iteration then read its target and held_value fields, causing a heap use-after-free. The issue reliably crashes instrumented WebContent builds and may enable memory corruption in production builds. The cited commit fixes the vulnerability. The excerpt does not identify affected versions.

### Source excerpt

CVE ID :CVE-2026-119332 Published : Oct. 30, 2026, 8:17 p.m. | 1 hour, 37 minutes ago Description :Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964, FinalizationRegistry::cleanup() in Libraries/LibJS/Runtime/FinalizationRegistry.cpp removed a dead record from m_records, retained an iterator to the next FinalizationRecord, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, remove_by_token() freed the node referenced by the retained iterator, and the next cleanup iteration read its target and held_value fields after free. This reliably crashes instrumented WebContent builds and creates a memory-corruption primitive in production builds. This vulnerability is fixed by commit 209579c96473c75bd5eba9701fcadb841a045964. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## simdjson 5.0 is out

DevFeed: [simdjson 5.0 is out](<https://devfeed.tech/articles/simdjson-5-0-is-out-61355.md>)

Original publisher: [Read original article](<https://lemire.me/blog/2026/09/28/simdjson-5-0-is-out/>)

Author: Daniel Lemire

Published: 2026-09-28T12:38:25Z

Content type: release

Language: en

Sources: [Daniel Lemire](<https://devfeed.tech/sources/daniel-lemire.md>)

Topics: [JSON](<https://devfeed.tech/topics/json.md>), [Library](<https://devfeed.tech/topics/library.md>), [static linking](<https://devfeed.tech/topics/static-linking.md>), [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [Test-driven development](<https://devfeed.tech/topics/tdd.md>)

Tags: [apache](<https://devfeed.tech/tags/apache.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [c-plus-plus-26](<https://devfeed.tech/tags/c-plus-plus-26.md>), [clickhouse](<https://devfeed.tech/tags/clickhouse.md>), [gcc](<https://devfeed.tech/tags/gcc.md>), [js](<https://devfeed.tech/tags/js.md>), [json](<https://devfeed.tech/tags/json.md>), [ladybird](<https://devfeed.tech/tags/ladybird.md>), [meta](<https://devfeed.tech/tags/meta.md>), [node-js](<https://devfeed.tech/tags/node-js.md>)

### AI overview

simdjson 5.0 adds default key-selector deserialization for reflected C++ structures, improved handling of large integers, JSON text sequences and comma-separated document streams, and options for line-based and threaded parsing. It also includes bug fixes following an audit.

### Source excerpt

The simdjson library is a C++ library to parse and generate JSON. It is used in Node.js, ClickHouse, Meta Velox, StarRocks, Apache Doris, the Ladybird browser and many other systems. We released version 4.0 a year ago, in September 2025. Its headline feature was C++26 static reflection: you could turn a C++ structure into JSON, ... Continue reading simdjson 5.0 is out

## Ladybird: A new cross-platform browser project

DevFeed: [Ladybird: A new cross-platform browser project](<https://devfeed.tech/articles/ladybird-a-new-cross-platform-browser-project-38358.md>)

Original publisher: [Read original article](<https://awesomekling.github.io/Ladybird-a-new-cross-platform-browser-project/>)

Author: Andreas Kling

Published: 2022-09-12T00:00:00Z

Content type: article

Language: en

Sources: [Andreas Kling](<https://devfeed.tech/sources/andreas-kling.md>)

Topics: [browser](<https://devfeed.tech/topics/browser.md>), [cross-platform](<https://devfeed.tech/topics/cross-platform.md>), [C++](<https://devfeed.tech/topics/c-plus-plus.md>), [Web](<https://devfeed.tech/topics/web.md>), [CSS](<https://devfeed.tech/topics/css.md>), [Document Object Model (DOM)](<https://devfeed.tech/topics/dom.md>), [ECMAScript](<https://devfeed.tech/topics/ecmascript.md>), [HTML](<https://devfeed.tech/topics/html.md>), [Qt](<https://devfeed.tech/topics/qt.md>), [Graphics](<https://devfeed.tech/topics/graphics.md>), [SVG](<https://devfeed.tech/topics/svg.md>)

Tags: [browser](<https://devfeed.tech/tags/browser.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [cross-platform](<https://devfeed.tech/tags/cross-platform.md>), [css](<https://devfeed.tech/tags/css.md>), [gui](<https://devfeed.tech/tags/gui.md>), [html](<https://devfeed.tech/tags/html.md>), [ladybird](<https://devfeed.tech/tags/ladybird.md>), [serenityos](<https://devfeed.tech/tags/serenityos.md>), [svg](<https://devfeed.tech/tags/svg.md>), [technical](<https://devfeed.tech/tags/technical.md>)

### AI overview

The post introduces Ladybird, a cross-platform browser built from the SerenityOS LibWeb and LibJS engines. It explains the project's origins, its shift from a SerenityOS browser engine toward a broader cross-platform browser, and its C++ architecture using Qt, HTML, DOM, CSS, SVG, ECMAScript, graphics, and image-format components.

### Source excerpt

This post describes the Ladybird browser, based on the LibWeb and LibJS engines from SerenityOS.