Ladybird WASM ESM bug yields web-reachable code execution

Ladybird is exposed to web-reachable code execution through a dangling-reference flaw in its WebAssembly ESM integration, tracked as CVE-2026-58592.

When JavaScript functions are imported into a WebAssembly module over the ESM path, a stack-local function type is passed by reference into host-function creation. The host callback keeps that reference and reads it after the link-loop iteration ends and the type object is destroyed. The ordinary instantiate path, which keeps a long-lived reference, is unaffected.

Stale result-type data lets the callback return an empty result where the module expects a non-empty one. An attacker-influenced value then survives in a destination register and is later treated as an array instance pointer after only a null check, producing an arbitrary write. Shannon Booth reports the chain is reachable from ordinary HTML with no instrumentation or source changes, and lands code execution inside the WebContent process.

The issue is scored 8.3 (CVSS 3.1) and 8.9 (CVSS 4.0). It maps to expired-pointer and type-confusion weaknesses that turn a transient loader bug into a cross-origin process compromise for anyone rendering untrusted pages in Ladybird.