Lady loader. When a JavaScript function is imported via the ESM path a stack‑local FunctionType is passed by reference to create_host_function. The resulting host callback later dereferences that reference after the FunctionType has been destroyed, leaving a dangling reference. The stale result‑type data leads the callback to return an empty result vector for a non‑empty result, causing an attacker‑controlled value to appear in a destination register. That value is then consumed by the WebAssembly GC array.set handler, which bit‑casts the low bits to an ArrayInstance pointer after only a null check, resulting in an arbitrary write. The arbitrary write can be chained to code execution in the WebContent process. The flaw is identified as dangling reference (CWE‑787), unchecked null dereference (CWE‑825), and improper type conversion (CWE‑843).

The vulnerability affects the Ladybird web browser. Any release that includes the WebAssembly ESM integration module loader is potentially impacted; no specific version ranges are listed. A web page that imports a .wasm module via ESM can trigger the exploit, and the flaw is reachable directly from arbitrary HTML content without the need for source modification or user interaction.

The CVSS score of 8.9 indicates high severity, while the EPSS score of less than 1 percent suggests exploitation is currently unlikely but possible. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is web‑reachable: an attacker only needs to host or deliver a malicious .wasm module in an ESM context, which a victim’s browser will load automatically, enabling code execution inside the WebContent process.