Ladybird

Ladybird Browser WebAssembly ESM Host-Function Use-After-Free RCE

The PoC targets a lifetime bug in Ladybird's WebAssembly ESM import path: WebAssemblyModule.cpp builds a Wasm::FunctionType as a stack-local value and passes it by reference into createhostfunction(), so the resulting long-lived JS host callback retains a…