Summary
Ladybird's CSSOM stylesheet APIs failed to enforce the origin-clean restriction for cross-origin stylesheets loaded without CORS. A malicious webpage could read stylesheet rules or modify a victim stylesheet, potentially exposing sensitive rule text or changing page presentation.
Ladybird's CSSOM stylesheet APIs failed to enforce the origin-clean restriction for cross-origin stylesheets loaded without CORS. A malicious webpage could read stylesheet rules or modify a victim stylesheet, potentially exposing sensitive rule text or changing page presentation.
Affected context
The issue occurs in Ladybird's CSS stylesheet implementation when CSSStyleSheet.cssRules, insertRule(), or deleteRule() operates on a stylesheet marked non-origin-clean because it was loaded cross-origin without appropriate CORS permission. The stylesheet could be correctly identified as cross-origin while the associated SecurityError checks were still omitted.
The issue occurs in Ladybird's CSS stylesheet implementation when CSSStyleSheet.cssRules, insertRule(), or deleteRule() operates on a stylesheet marked non-origin-clean because it was loaded cross-origin without appropriate CORS permission. The stylesheet could be correctly identified as cross-origin while the associated SecurityError checks were still omitted.
Exploit preconditions
- Attack surface: Browser-exposed CSSOM stylesheet APIs
- Required access: Ability to load or interact with a victim page and its cross-origin stylesheet context
- Trigger point: Reading rules through cssRules or modifying them through insertRule() or deleteRule()
- Why exploitation is possible: The APIs did not consistently enforce the stylesheet origin-clean flag before exposing or changing protected rule data
- Attack surface: Browser-exposed CSSOM stylesheet APIs
- Required access: Ability to load or interact with a victim page and its cross-origin stylesheet context
- Trigger point: Reading rules through cssRules or modifying them through insertRule() or deleteRule()
- Why exploitation is possible: The APIs did not consistently enforce the stylesheet origin-clean flag before exposing or changing protected rule data
Why this happens
The underlying bug was incomplete enforcement of the browser's origin-clean security invariant in CSSStyleSheet operations. Although cross-origin imported stylesheets were marked non-origin-clean, the relevant APIs failed to reject unauthorized reads and mutations with the required SecurityError. This maps primarily to CWE-346: Origin Validation Error, with information exposure also relating to CWE-200.
The underlying bug was incomplete enforcement of the browser's origin-clean security invariant in CSSStyleSheet operations. Although cross-origin imported stylesheets were marked non-origin-clean, the relevant APIs failed to reject unauthorized reads and mutations with the required SecurityError. This maps primarily to CWE-346: Origin Validation Error, with information exposure also relating to CWE-200.
Potential impact
- A malicious page could read selectors, generated-content text, feature markers, or other rule content
- An attacker could alter stylesheet rules and change page visibility, layout, or presentation
- Sensitive implementation or application information embedded in CSS could be disclosed
- Cross-origin isolation guarantees for stylesheet data could be weakened
- A malicious page could read selectors, generated-content text, feature markers, or other rule content
- An attacker could alter stylesheet rules and change page visibility, layout, or presentation
- Sensitive implementation or application information embedded in CSS could be disclosed
- Cross-origin isolation guarantees for stylesheet data could be weakened
General mitigation guidance
Mitigation focuses on making origin-clean enforcement a mandatory security gate for every CSSOM operation that reads or mutates stylesheet state.
Common defensive patterns include:
- Rejecting protected stylesheet reads and mutations with the required security exception
- Centralizing origin and permission checks so related APIs cannot diverge
- Treating cross-origin stylesheets without valid CORS authorization as untrusted
- Applying the same-origin policy consistently across parsed rules, imported sheets, and stylesheet mutation paths
- Adding regression tests for unauthorized reads and writes across CSSOM entry points
- Limiting sensitive information in publicly served CSS where practical
Mitigation focuses on making origin-clean enforcement a mandatory security gate for every CSSOM operation that reads or mutates stylesheet state.
Common defensive patterns include:
- Rejecting protected stylesheet reads and mutations with the required security exception
- Centralizing origin and permission checks so related APIs cannot diverge
- Treating cross-origin stylesheets without valid CORS authorization as untrusted
- Applying the same-origin policy consistently across parsed rules, imported sheets, and stylesheet mutation paths
- Adding regression tests for unauthorized reads and writes across CSSOM entry points
- Limiting sensitive information in publicly served CSS where practical
How teams detect issues like this
Organizations can detect similar issues through:
- Static analysis and code review for CSSOM methods that expose or mutate parsed stylesheet data without security checks
- Tests covering origin-clean state transitions, cross-origin imports, CORS authorization, and expected SecurityError behavior
- Review signals showing duplicated or missing origin-validation logic across related APIs
- Browser security policy enforcement and regression suites that compare read and mutation behavior for same-origin and cross-origin sheets
- Automated security testing tools that exercise cross-origin resource and DOM API boundaries
Organizations can detect similar issues through:
- Static analysis and code review for CSSOM methods that expose or mutate parsed stylesheet data without security checks
- Tests covering origin-clean state transitions, cross-origin imports, CORS authorization, and expected SecurityError behavior
- Review signals showing duplicated or missing origin-validation logic across related APIs
- Browser security policy enforcement and regression suites that compare read and mutation behavior for same-origin and cross-origin sheets
- Automated security testing tools that exercise cross-origin resource and DOM API boundaries
