CVE-2025-47154: Ladybird LibJS RCE Vulnerability

CVE-2025-47154 Overview

CVE-2025-47154 is a critical use-after-free vulnerability in LibJS, the JavaScript engine used by the Ladybird browser. The vulnerability exists in the ECMAScriptFunctionObject::internal_construct function where the vector that arguments_list references is improperly freed, leading to a use-after-free condition. Remote attackers can exploit this vulnerability to execute arbitrary code by crafting a malicious JavaScript file.

The Ladybird browser is an independent, open-source web browser project. While the project is noted to be in a pre-alpha state and "only suitable for use by developers," the vulnerability nonetheless represents a serious security concern for anyone using the browser for testing or development purposes.

Critical Impact

Remote attackers can achieve arbitrary code execution through a crafted JavaScript file, potentially leading to complete system compromise when a user visits a malicious webpage or executes a crafted .js file.

Affected Products

• Ladybird Browser (versions before commit f5a6704)
• LibJS JavaScript Engine (integrated within Ladybird)
• All platforms running affected Ladybird versions

Discovery Timeline

• May 1, 2025 - CVE-2025-47154 published to NVD
• May 2, 2025 - Last updated in NVD database

Technical Details for CVE-2025-47154

Vulnerability Analysis

This use-after-free vulnerability occurs in the JavaScript engine's handling of function construction. The root issue lies in how the arguments_list vector is managed during the execution context creation for ECMAScript function objects. When a function is constructed, the arguments are passed via a vector reference, but the underlying memory can be freed while still being referenced, creating a classic use-after-free scenario.

The vulnerability is remotely exploitable via network-delivered JavaScript content. No privileges or user interaction beyond visiting a malicious page are required, and successful exploitation can impact resources beyond the vulnerable component's security scope.

Root Cause

The vulnerability stems from improper memory management in the ECMAScriptFunctionObject::internal_construct function within LibJS. Specifically, the code failed to properly copy the arguments data into the execution context before the source vector could potentially be freed. This is categorized under CWE-820 (Missing Synchronization), indicating a timing-related memory safety issue where the vector's lifetime was not properly synchronized with its usage.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver a crafted JavaScript file to the victim. This could be accomplished through:

1. Hosting malicious JavaScript on a web server and enticing a user to visit the page
2. Injecting malicious JavaScript into a compromised website
3. Delivering a malicious .js file that the victim opens directly

The vulnerability allows attackers to manipulate freed memory, potentially achieving arbitrary code execution with the privileges of the browser process.

// Security patch from Libraries/LibJS/Runtime/ECMAScriptFunctionObject.cpp
// Fix: Copy arguments into execution context immediately to prevent UAF

 {
     auto& vm = this->vm();
 
+    auto callee_context = ExecutionContext::create();
+
+    // Non-standard
+    callee_context->arguments.ensure_capacity(max(arguments_list.size(), m_formal_parameters.size()));
+    callee_context->arguments.append(arguments_list.data(), arguments_list.size());
+    callee_context->passed_argument_count = arguments_list.size();
+    if (arguments_list.size() < m_formal_parameters.size()) {
+        for (size_t i = arguments_list.size(); i < m_formal_parameters.size(); ++i)
+            callee_context->arguments.append(js_undefined());
+    }
+
     // 1. Let callerContext be the running execution context.
     // NOTE: No-op, kept by the VM in its execution context stack.

Source: GitHub Commit Update

Detection Methods for CVE-2025-47154

Indicators of Compromise

• Unusual memory access patterns in browser processes executing JavaScript
• Crash dumps indicating heap corruption or invalid memory access in LibJS components
• Suspicious JavaScript files with complex argument manipulation patterns designed to trigger memory corruption
• Process memory anomalies following execution of untrusted JavaScript content

Detection Strategies

• Deploy memory safety monitoring tools to detect heap corruption and use-after-free conditions
• Implement browser-level sandboxing and process isolation to contain potential exploitation
• Monitor for anomalous behavior in Ladybird browser processes, particularly during JavaScript execution
• Use endpoint detection solutions capable of identifying memory exploitation techniques

Monitoring Recommendations

• Enable crash reporting and analyze any crashes occurring in LibJS or related browser components
• Monitor network traffic for suspicious JavaScript delivery to Ladybird browser instances
• Implement logging for browser process behavior to detect potential exploitation attempts
• Consider using memory-safe debugging tools during Ladybird browser development and testing

How to Mitigate CVE-2025-47154

Immediate Actions Required

• Update Ladybird browser to a version that includes commit f5a6704 or later
• Avoid using vulnerable versions of Ladybird to browse untrusted websites
• Consider temporarily disabling JavaScript execution in Ladybird until patched
• Review the exploit analysis to understand the attack surface

Patch Information

The vulnerability has been addressed in commit f5a670421954fc7130c3685b713c621b29516669 in the Ladybird repository. The fix ensures that arguments are immediately copied into the execution context before any operations that could free the source vector, preventing the use-after-free condition.

Users should pull the latest changes from the Ladybird GitHub repository and rebuild the browser to apply the security fix.

Workarounds

• Disable JavaScript execution in Ladybird browser configuration until the patch is applied
• Use the browser only for trusted, local development content rather than browsing external websites
• Consider using an alternative browser for general web browsing until the vulnerability is patched
• Implement network-level filtering to block potentially malicious JavaScript content

# Configuration example - Rebuild Ladybird with the security patch
git clone https://github.com/LadybirdBrowser/ladybird.git
cd ladybird
git checkout f5a670421954fc7130c3685b713c621b29516669
# Follow build instructions for your platform
./Meta/ladybird.sh run ladybird