TLDR Tech / InfoSec
Nightmare of the JavaScript Optimization
A researcher has discovered a patched use-after-free (GHSA-w89h-j2xg-c457) in the Ladybird browser, where WebAssembly SharedArrayBuffer growth caused dangling pointers in its JavaScript engine. The assembly interpreter's fast path bypassed validation, allowing an exploit chain that leveraged FixedArray overlap and fake TypedArrays to achieve RCE via vtable falsification and libc system() calls. Defenders should monitor rapid TypedArray allocations, enforce bounds checking on interpreter fast paths, and ensure that cached pointers are invalidated during memory reallocations.
Read the full story