Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119331— Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

Quick assessment

Affected
LadybirdBrowser ladybird
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ladybird 是一款真正独立的网络浏览器。在提交 c0d68bddf3e3616e5173835f0f4c155ee9700d91 之前，Libraries/LibWeb/CSS/CSSStyleSheet.cpp 中的 CSSStyleSheet.cssRules、insertRule() 和 deleteRule() 未按要求对样式表的 origin-clean（来源纯净）标志实施 SecurityError 检查，尽管跨域导入的样式表已被正确标记为 non-origin-clean（非来源纯净）。恶意页面

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119331

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation
Source: CVE Program / CVE List V5
Vulnerability Description
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
LadybirdBrowser ladybird < c0d68bddf3e3616e5173835f0f4c155ee9700d91 -

II. Public POCs for CVE-2026-119331

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119331

请登录查看更多情报信息。

Other References for CVE-2026-119331 (2)

IV. Related Vulnerabilities

Same product: ladybird
Same vendor: LadybirdBrowser
Same weakness: CWE-200