Ladybird versions before commit 2f9dc7e implement a WebAssembly ESM integration that passes a stack‑local Wasm::FunctionType by reference to create_host_function. When the ESM link-loop ends, this reference is freed, yet the host callback continues to use it, yielding a dangling reference. The stale result-type data causes the callback to return an empty result vector for a statically non‑empty result. As a consequence, an attacker‑controlled value is left in a destination register, which the WASM‑GC array.set handler subsequently bit‑casts to an ArrayInstance pointer after only a null check. This produces an arbitrary write that can be chained to execute arbitrary code in the WebContent process. The flaw is reachable from an ordinary web page without needing extra instrumentation and is identified as a dangling reference (CWE‑787), unchecked null dereference (CWE‑825), and improper type conversion (CWE‑843).

The vulnerability affects the Ladybird web browser. Any release that includes the WebAssembly ESM integration module loader is potentially impacted; no specific version ranges are listed. A web page can chain this into code execution in the WebContent process.

The CVSS score of 8.9 indicates high severity, while the EPSS score of less than 1 percent suggests exploitation is but possible. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is web‑reachable: an attacker only needs to host or deliver a malicious .wasm module in an ESM context, which a victim’s browser will load automatically, enabling code execution inside the WebContent process.