Ladybird WebAssembly ESM Host Function RCE Vulnerability and PoC Analysis

Vulnerability Overview This vulnerability involves a Remote Code Execution (RCE) Proof of Concept (PoC) targeting Ladybird WebAssembly ESM host functions. The vulnerability combines two browser-accessible primitives: 1. A lifecycle bug in WebAssembly ESM host functions allows consuming stale Wasm registers as references to abstract Wasm GC arrays. 2. Memory and library pointer leakage from ImageData and WebGL readback, recovering from the backing store, to stabilize native write paths. Scope Target: Upstream Ladybird commit . Environment: Headless mode with the standard Ladybird browser binary. Dependencies: The page does not rely on , layout includes, internal patches, or source patches. Remediation 1. Host Function Callbacks: Host function callbacks must either use the canonical created upon construction or capture a stable reference to storage owned by the caller. 2. Wasm Interpreter: The Wasm interpreter must validate that the host result arity matches the caller's static result type before returning from bytecode execution. If the host function returns zero values, the target registers along the path should be cleared or overwritten. 3. Leak Phase: should avoid caching raw pointers to user-provided typed array backing stores, as these addresses may change. Re-deriving the backing pointer and byte length at runtime will eliminate stale bitmap pointers. POC Code File Usage poc.html: Standalone browser HTML exploitation page. README.md: Reproduction instructions, source tracking, and exploitation design. Test Targets Components and Offsets: - : - : - : - : - : - : - : Root Cause Library File: creates JS host callbacks using a type parameter. ESM Import Path: constructs the function type as a stack local variable before passing it to . Bytecode Interpreter: accepts a dynamic result vector returned by host functions without enforcing a match with the static function type at the call site. Leak Primitives ImageData: directly wraps the backing store of . Bitmap: stores this pointer in a non-owning bitmap wrapper. memory64: uses a fallback instead of fixed reservations. When growing memory, the bitmap still points to the old address. The PoC fills the old area with predictable JS objects and Wasm GC objects, then restores pointer-shaped values using and . Exploitation Path 1. Import a JavaScript function into a WebAssembly ESM module with a static result type of . 2. Trigger a dangling reference to within the host callback. 3. Force the host callback to dynamically return zero Wasm values. 4. Retain stale registers containing attacker-shaped abstract GC references. 5. Write a forged using Wasm GC . 6. Redirect backing store to gain native read/write access. 7. Resolve the base addresses of and libc from leaked pointers. 8. Forge virtual dispatch targets and frames. 9. Trigger a WebGL virtual call and execute marked commands.

Goal Reached Thanks to every supporter — we hit 100%!

Ladybird WebAssembly ESM Host Function RCE Vulnerability and PoC Analysis

More from this source