Ladybird's September Update Adds macOS Hardware Video Decoding and a Separate Media Process After a Week of Security Testing With Trail of Bits
Ladybird's September report covers a week of Trail of Bits security testing, VideoToolbox hardware decoding on macOS, a separate media process, OffscreenCanvas and a crash reporter.
Overview
Ladybird, the independent open-source web browser, published its September progress report on September 30, describing a week of security testing with Trail of Bits, hardware video decoding on macOS, a separate process for media playback, and a new crash reporter. According to the Ladybird newsletter, several items on the project’s road to alpha testing are now in place, including automatic filter-list updates and crash reporting that does not require a terminal.
Security testing and process isolation
The project said it spent a week working with Trail of Bits security engineers through Patch the Planet, a program sponsored by OpenAI. The engineers used a swarm of OpenAI frontier models to find security issues, reported everything they found and crafted a few full exploit chains, according to the same newsletter, which said the work left the project with a considerable security backlog.
Several fixes followed. The browser’s network process now handles cookies for HTTP responses and WebSocket handshakes, and the browser terminates any renderer that asks for access to HttpOnly cookies, per the newsletter. The underlying pull request, merged September 19, moves cookie and HSTS header handling out of the renderer; only WebDriver and test mode retain renderer-side access to HTTP cookie operations.
The newsletter also lists tighter helper sandboxes. On macOS, Ladybird now uses the hardened runtime to restrict executing code from writable memory. On Linux, Landlock filesystem restrictions are applied before GPU-driver threads start, and helpers refuse to start without Landlock by default. Cross-site iframes can now run in separate processes, though the newsletter says normal browsing still isolates at the top level and embedded frames stay with their containing page.
Media: hardware decoding and a separate process
Video playback on macOS now uses hardware decoding through VideoToolbox for H.264, HEVC, VP9 and AV1, according to the newsletter. The pull request that introduced it, merged September 10, reports playback CPU usage falling from a range of 45 to 90 percent to roughly 20 to 21 percent.
Decoding and playback for audio and video elements also moved into a separate media process, merged September 27. As the newsletter describes it, a media-process crash now becomes a playback error, and the renderer no longer needs decoder-service permissions. To prepare for distribution, the project removed the patent-encumbered H.264, HEVC and AAC decoders from its bundled FFmpeg build; on Linux they load from the system FFmpeg when available.
Performance and web platform work
The report attributes several CPU and memory problems to specific sites. An ad library on Politico polled with a chain of zero-delay timers that skipped the required 4 ms minimum delay; fixing that cut its CPU cost. Pages that reload themselves on a timer kept every replaced document alive, and in background tabs Politico reached 11 GB after four hours while El País reached 15 GB after twenty, according to the newsletter. Fixes let replaced documents be collected.
On the project’s continuous Linux runner, scores rose by about 30 percent in Speedometer 2, 50 percent in Speedometer 3 and 80 percent in StyleBench over September, per the newsletter.
OffscreenCanvas now supports 2D, WebGL and WebGL2 rendering in pages and workers, enabled by default, in a pull request merged September 28. The project’s Web Platform Tests score rose from 2,088,677 to 2,109,072 subtests, a gain of 20,395; the newsletter says about half came from tests added upstream during the month, which raised every browser’s count.
User-facing changes
Ladybird added a force-dark setting in about:settings for pages without a dark theme, with lightness adjustment done in the Oklab color space, per the newsletter. A content-blocking pull request, merged September 10, adds a built-in catalog of filter lists covering ads, tracking and cookie notices, all disabled by default, plus support for user-supplied list URLs. The newsletter says enabled automatic updates check for fresh copies at startup and daily.
The new crash reporter saves local reports on macOS and Linux, with a pull request specifying that no automatic uploads occur and the newest 20 files are retained. The newsletter says reports contain no browsing data or local file paths and that users decide whether to send them to the project’s crash report service.
Ladybird also consolidated its desktop interface. A pull request merged September 29 removed the AppKit port, which had fallen behind the Qt version, leaving Qt as the default frontend on all platforms except Android.
What We Don’t Know
None of the sources reviewed gives a date for the alpha release. The newsletter describes this work as preparation for alpha testing but does not say when testing will begin. The Trail of Bits security backlog is described only as considerable; the number and severity of the reported issues were not disclosed in the newsletter.