Ladybird Browser failed to enforce the stylesheet origin‑clean flag when accessing or manipulating CSSStyleSheet objects. A page from one origin could read the CSS rules of a stylesheet imported from another origin without CORS and could also insert or delete rules, violating the Same‑Origin Policy. This information‑exposure flaw (CWE‑200) and the failure to check the origin‑clean status (CWE‑346) could reveal selectors, generated content, feature markers, or other sensitive rule text. The modification capability could change page visibility or layout, potentially disrupting user experience or enabling subtle manipulation of content. The flaw does not lead to memory corruption, code execution, or persistence after the attacker page closes.

Ladybird Browser is the only vendor/product listed as affected. Specific version ranges are not disclosed in the CVE entry, so administrators should verify their installation against the latest release that includes the fix in commit c0d68bddf3e3616e5173835f0f4c155ee9700d91 and consider upgrading if they are using an older revision.

The CVSS score of 7.1 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed in CISA KEV, so the exact exploitation prevalence cannot be quantified. The attack vector is inferred to be a malicious web page that would exploit the browser's lack of origin enforcement. An attacker could host a page that imports cross‑origin stylesheets without CORS, read the parsed rules, and alter or remove rules to influence the victim’s page visibility or layout. The impact is primarily confidential data leakage and UI manipulation rather than remote code execution. Given the high CVSS score, this vulnerability merits prompt attention.