--- title: This Month in Ladybird | daily.dev description: Ladybird's July update covers new private browsing windows, browser profiles for isolating settings and storage, undo/redo with rich text editing support,... canonical: https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Month in Ladybird | daily.dev og:description: Ladybird's July update covers new private browsing windows, browser profiles for isolating settings and storage, undo/redo with rich text editing support,... og:url: https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe og:image: https://api.daily.dev/og/posts/5keVcfSxe.png og:image:alt: This Month in Ladybird og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Month in Ladybird **[Ladybird Browser](https://daily.dev/sources/ladybird)** · 14 min read · 64 upvotes · 4 comments ## Summary Ladybird's July update covers new private browsing windows, browser profiles for isolating settings and storage, undo/redo with rich text editing support, opt-in geolocation, and working WebAudio. Under the hood, the team moved much of the style and layout pipeline from C++ to Rust to enable future parallelism, built a custom typed language ('flap') to generate the JavaScript interpreter's hot/cold bytecode handlers for better performance, sandboxed ArrayBuffer and WebAssembly memory inside a 4 TiB caged region to blunt exploit primitives, sped up WebAssembly calls by 20-50x, and improved compositor performance for video, scrolling, and WebGL. Several real-world sites (streets.gl, GitHub code review, X.com, chatgpt.com) got compatibility fixes, and the Gtk port was dropped in favor of Qt. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Ladybird browser prevent ArrayBuffer exploits from reading arbitrary process memory? Ladybird now confines ArrayBuffer contents and WebAssembly memories inside one reserved 4 TiB region of address space, forcing every access to land within it. Previously, gaining control of an ArrayBuffer's data pointer let an attacker read or write all memory in the process; an out-of-bounds access can still corrupt other buffers inside the cage, but it can no longer reach objects, stacks, or code outside it. _Track exploit-mitigation changes like this cage design as you evaluate browser engine security on daily.dev._ ### Why did Ladybird rewrite its JavaScript bytecode interpreter using a custom typed language instead of C++ macros? Ladybird built a typed language called flap, with its own compiler that generates x86-64 and AArch64 machine code at build time, to replace an untyped macro-based assembly dialect that had no way to check that values were written before read. The switch was performance-neutral on its own, but later specialization work built on top of it gained around 5% on compute-heavy JavaScript benchmarks. _Follow interpreter design tradeoffs like this when comparing JS engine performance work on daily.dev._ ### How much faster did WebAssembly function calls get in Ladybird after the July 2026 update? Common call cases in Ladybird's WebAssembly implementation became 20x to 50x faster on call microbenchmarks after calls were made to happen directly instead of going through a helper. Additional operations were also moved inline for the same reason, part of a broader push to move style and layout to Rust and speed up the compositor that same month. _Keep up with browser engine performance shifts like this WebAssembly speedup on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@apperside** · 1 upvotes > Wow! Didn't know about this project, looks very promising and is sponsored by really big names, will definitely follow how it evolves **@agustinbarrientos** · 0 upvotes > Try publishing exploit regression tests around the ArrayBuffer cage. One should attempt cross-buffer reads after memory growth. Another should verify that pointers can't escape the reserved region. **@andradei** · 0 upvotes > > Gtk replaced by Qt > > Noooooo. > > Well both of them are terrible to package and distribute unless statically compiled while is another massive headache... but still. ## Similar posts on daily.dev - [This Month in Ladybird](https://daily.dev/posts/this-month-in-ladybird-wmtgqhzgv) · Hacker News · 12 upvotes · 2 comments --- Tags: [#javascript](https://daily.dev/tags/javascript), [#rust](https://daily.dev/tags/rust), [#webassembly](https://daily.dev/tags/webassembly) [View this post on daily.dev](https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Month in Ladybird","url":"https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe"},"datePublished":"2026-08-31T05:54:46.420Z","dateModified":"2026-08-31T05:56:24.468Z","description":"Ladybird's July update covers new private browsing windows, browser profiles for isolating settings and storage, undo/redo with rich text editing support,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f0d04d597be9efdaf11883698ad30378?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f0d04d597be9efdaf11883698ad30378?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ladybird Browser","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ladybird Browser","logo":"https://media.daily.dev/image/upload/s--gBOjamNh--/f_auto,q_auto/v1788155675/logos/ladybird?_a=BAMAMicg0","url":"https://daily.dev/sources/ladybird"},"commentCount":4,"discussionUrl":"https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":64},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":4}],"keywords":"javascript,rust,webassembly","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ladybird Browser","item":"https://daily.dev/sources/ladybird"},{"@type":"ListItem","position":3,"name":"This Month in Ladybird"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe","comment":[{"@type":"Comment","text":"Wow! Didn’t know about this project, looks very promising and is sponsored by really big names, will definitely follow how it evolves","datePublished":"2026-09-03T10:45:11.518Z","url":"https://daily.dev/posts/5keVcfSxe#c-6qeovZiuE","author":{"@type":"Person","name":"Apperside","url":"https://daily.dev/apperside","image":"https://avatars.githubusercontent.com/u/5955338?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Try publishing exploit regression tests around the ArrayBuffer cage. One should attempt cross-buffer reads after memory growth. Another should verify that pointers can’t escape the reserved region.","datePublished":"2026-09-03T16:02:21.878Z","url":"https://daily.dev/posts/5keVcfSxe#c-4dN2LHFQJ","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"}},{"@type":"Comment","text":"Gtk replaced by Qt\n\nNoooooo.\nWell both of them are terrible to package and distribute unless statically compiled while is another massive headache… but still.","datePublished":"2026-09-08T13:55:06.112Z","url":"https://daily.dev/posts/5keVcfSxe#c-fDhiFolC3","author":{"@type":"Person","name":"Isaac de Andrade","url":"https://daily.dev/andradei","image":"https://avatars.githubusercontent.com/u/2653546?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-month-in-ladybird-5kevcfsxe#faq","mainEntity":[{"@type":"Question","name":"How does Ladybird browser prevent ArrayBuffer exploits from reading arbitrary process memory?","acceptedAnswer":{"@type":"Answer","text":"Ladybird now confines ArrayBuffer contents and WebAssembly memories inside one reserved 4 TiB region of address space, forcing every access to land within it. Previously, gaining control of an ArrayBuffer's data pointer let an attacker read or write all memory in the process; an out-of-bounds access can still corrupt other buffers inside the cage, but it can no longer reach objects, stacks, or code outside it. Track exploit-mitigation changes like this cage design as you evaluate browser engine security on daily.dev."}},{"@type":"Question","name":"Why did Ladybird rewrite its JavaScript bytecode interpreter using a custom typed language instead of C++ macros?","acceptedAnswer":{"@type":"Answer","text":"Ladybird built a typed language called flap, with its own compiler that generates x86-64 and AArch64 machine code at build time, to replace an untyped macro-based assembly dialect that had no way to check that values were written before read. The switch was performance-neutral on its own, but later specialization work built on top of it gained around 5% on compute-heavy JavaScript benchmarks. Follow interpreter design tradeoffs like this when comparing JS engine performance work on daily.dev."}},{"@type":"Question","name":"How much faster did WebAssembly function calls get in Ladybird after the July 2026 update?","acceptedAnswer":{"@type":"Answer","text":"Common call cases in Ladybird's WebAssembly implementation became 20x to 50x faster on call microbenchmarks after calls were made to happen directly instead of going through a helper. Additional operations were also moved inline for the same reason, part of a broader push to move style and layout to Rust and speed up the compositor that same month. Keep up with browser engine performance shifts like this WebAssembly speedup on daily.dev."}}]} ```