Ladybird’s 2026 Alpha Milestone: What a From-Scratch Browser Engine Actually Delivers (and Why It Isn’t Ready Yet)

Every few years a project announces it is building a new browser engine, and the announcement is usually the last interesting thing that happens. Ladybird is the exception that has kept going long enough to be worth measuring. Its published roadmap puts the first alpha in 2026, beta in 2027, and a general release in 2028 — and as of this writing the alpha has not shipped, which is exactly the right moment to be precise about what it will and won’t be.

An alpha is not a browser you switch to. It is the point at which a project believes the thing is complete enough to hand to people who will file good bug reports. Ladybird’s own framing has been consistent about this: the first alpha targets Linux and macOS, and it is aimed at developers and early adopters rather than at anyone’s daily driver.

What “From Scratch” Actually Means Here

The claim that matters is architectural. Ladybird’s rendering engine (LibWeb) and JavaScript engine (LibJS) are not forks of Blink, WebKit, or Gecko, and the project is explicit that no code was taken from them. That is a genuinely rare position — Brave, Arc, Vivaldi, Opera, and Edge are all Chromium; Firefox is the only shipping alternative most users will encounter, and Safari’s WebKit is the third.

The lineage runs through SerenityOS, where Ladybird began as a component in 2019 before Andreas Kling spun it into a separate project in September 2022. It is now developed under a nonprofit, funded by donations and sponsorships rather than a default-search deal. The distinction is not cosmetic. Every major browser’s economics are shaped by who pays for the search box, and a project with no search revenue and no telemetry pipeline has a different set of pressures acting on its defaults. Platinum-tier sponsors listed by the project include FUTO, Shopify, and Cloudflare.

That funding model is worth naming honestly rather than celebrating. Donation-funded means the project answers to a small number of sponsors and a donor base, not to a browser-market business plan. It removes the incentive to monetize browsing behavior; it does not remove the risk that funding thins out before 2028.

The Test Numbers, and What They Do and Don’t Prove

Web Platform Tests are the closest thing the web has to a conformance scoreboard, and Ladybird’s numbers have moved fast. The project’s own April 2026 newsletter reported roughly 2.07 million passing WPT subtests and a 97.8% pass rate across imported test262 JavaScript conformance subtests. Earlier third-party tracking placed Ladybird fourth on WPT overall — behind Chrome, Safari, and Firefox — with LibJS scoring as one of the more conformant JavaScript engines.

Take those figures for what they are. A high WPT subtest count means the engine implements a very large surface of specified behavior. It does not mean the engine is fast, memory-safe under adversarial input, or correct on the enormous body of real-world web behavior that no spec describes and no test suite covers. Every engine team knows the gap between “passes the tests” and “renders the actual web” is where most of the remaining work lives. Ladybird passing a couple of million subtests is evidence the foundations are real; it is not evidence the browser is finished.

The Rust Migration Is a Security Decision

Ladybird is primarily C++ and is incrementally porting subsystems to Rust rather than attempting a rewrite. In February 2026 the project landed a Rust reimplementation of the LibJS frontend pipeline — lexer, parser, AST, scope collector, and bytecode generator — enabled by default. Style and layout have been moving to Rust since.

The reasoning is the same one Mozilla and the Chromium team have both acted on: a browser parses hostile input from every site a user visits, and memory-safety bugs in parsers are the classic path from “visited a page” to “ran attacker code.” Porting the frontend pipeline first targets exactly the code that touches untrusted bytes earliest. A partially-ported engine still has C++ in the hot path, so the benefit is incremental rather than categorical — but the ordering is the right one.

Closing the Gate on Outside Code

On June 5, 2026, Kling announced that Ladybird would stop accepting public pull requests. All open PRs were closed; code changes now come only from maintainers. Outside contributors are directed toward bug reports, reduced test cases, standards discussion, website testing, security reports, and technical feedback.

The stated reason is worth reading carefully, because it is a security argument rather than a workload one. The project’s position is that AI tooling has broken the old signal where a substantial patch implied substantial effort and good faith — so a pull request now says less about who wrote it. For a browser, where a single well-disguised vulnerability is the whole attack, the maintainers concluded that every change entering the tree has to be code they own and understand.

It is a defensible call and an uncomfortable one. It trades the open-contribution model that built much of the project’s early momentum for a smaller, auditable trusted set right before the first release that outsiders will actually run. Whether that cost is worth paying is a judgment about threat model, and reasonable people in open source have landed on both sides of it.

What an Alpha Won’t Give You

Concretely, in 2026: Linux and macOS only. Windows support is planned for a later stage, and mobile is not a current focus. There is no released build to evaluate as of this writing, and the project has been clear the browser is not ready for everyday use.

The threat-model point deserves stating plainly, because it is the one users are most likely to get wrong. A brand-new engine with no search deal and no data collection sounds like a privacy win, and in terms of business incentives it is. But an alpha-stage engine has not been through years of adversarial security research, does not have a mature sandboxing and process-isolation story battle-tested against real exploitation, and does not have the incident-response machinery that ships an emergency patch to hundreds of millions of installs in days. If your threat model includes targeted attackers, an alpha browser is a worse choice than a mature one regardless of who funds it. If your interest is engine diversity and you are willing to file bugs, it is exactly the right thing to install.

The useful way to watch Ladybird over the next year is not the release date. It is whether the WPT curve keeps climbing after the alpha exposes the engine to sites nobody wrote a test for, and whether a maintainer-only tree can absorb the bug volume that a public alpha generates. Those two answers will say more about 2028 than the roadmap does.