Loading story…
WebKitGTK and WPE WebKit released security advisory WSA-2026-0002 addressing eight vulnerabilities in versions before 2.52.1, including a Same Origin Policy bypass, a Content Security Policy enforcement bypass, cross-origin access to script message handlers, cross-site scripting, user fingerprinting, and flaws tied to restricted content processing that could affect sandbox boundaries. The advisory also lists multiple memory-handling issues that can trigger crashes, broadening the impact beyond web security policy failures to application stability and potential exploitation risk.
The issues are tracked as CVE-2026-20643, CVE-2026-20664, CVE-2026-20665, CVE-2026-20691, CVE-2026-28857, CVE-2026-28859, CVE-2026-28861, and CVE-2026-28871. Debian separately published DSA-6172-1 for webkit2gtk, indicating downstream distribution updates are being issued to ship the fixes. Organizations using WebKitGTK-based browsers or embedded web views, as well as WPE WebKit deployments, should update to 2.52.1 or the corresponding vendor-patched packages to remediate the disclosed vulnerabilities.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
WebKitGTK and WPE WebKit published security advisory WSA-2026-0002 disclosing eight vulnerabilities affecting versions before 2.52.1, including Same Origin Policy and Content Security Policy bypasses, cross-site scripting, restricted content processing issues, and memory-handling flaws. The advisory recommended updating to the latest stable versions and listed CVE-2026-20643, CVE-2026-20664, CVE-2026-20665, CVE-2026-20691, CVE-2026-28857, CVE-2026-28859, CVE-2026-28861, and CVE-2026-28871.
Debian published security advisory DSA-6172-1 announcing a security update for webkit2gtk. The advisory indicates Debian shipped fixes for security issues affecting the package.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WebKitGTK and WPE WebKit published security advisory **`WSA-2026-0005`** disclosing nine vulnerabilities across multiple releases of the browser engine, including memory handling errors, out-of-bounds access, use-after-free bugs, permissions validation issues, state management problems, privacy leakage, denial-of-service, UI spoofing, and an iframe sandbox policy bypass. The affected issues are tracked as **`CVE-2026-28984`**, **`CVE-2026-43804`**, **`CVE-2026-64713`**, **`CVE-2026-64719`**, **`CVE-2026-64728`**, **`CVE-2026-64730`**, **`CVE-2026-64757`**, **`CVE-2026-64783`**, and **`CVE-2026-64787`**, with fixes delivered in versions **2.52.4**, **2.52.5**, and **2.52.6** depending on the flaw. One of the patched bugs, **`CVE-2026-64783`**, is a WebKit use-after-free that Apple said could crash devices when processing malicious web content. Apple included the issue in security updates for **macOS Tahoe 26.6** and **iOS/iPadOS 26.6**, and explicitly credited **GLM from Z.AI** as the accepted reporter, highlighting a case where an AI model was named in vulnerability discovery attribution. Organizations using WebKit-based components on Linux and Apple platforms have been urged to update to the latest stable releases.
Aug 20, 2026
Red Hat has released **Important** security updates for `webkitgtk4` and `webkit2gtk3` across supported **RHEL 7 ELS, RHEL 8, and RHEL 9** product streams, updating affected packages to **WebKitGTK 2.52.5**. The advisories cover a broad set of vulnerabilities disclosed upstream in **WebKitGTK/WPE WebKit advisory `WSA-2026-0004`**, including memory corruption, use-after-free, out-of-bounds read and write, sandbox escape or bypass, sensitive data disclosure, denial-of-service crashes, and clipboard hijacking triggered by malicious web content. Red Hat also included a fix for **`CVE-2024-4367`**, an arbitrary JavaScript execution flaw in Mozilla **PDF.js**. The patched issues include higher-severity WebKitGTK bugs such as **`CVE-2026-43705`** and **`CVE-2026-43715`** (both **CVSS 8.8**), alongside multiple moderate flaws including **`CVE-2026-43721`** for clipboard hijacking and several crash-prone memory-handling bugs such as **`CVE-2026-43707`**, **`CVE-2026-43712`**, **`CVE-2026-43663`**, **`CVE-2026-43676`**, **`CVE-2026-43726`**, **`CVE-2026-43727`**, **`CVE-2026-43734`**, and **`CVE-2026-43742`**. Red Hat said the flaws can be exploited through crafted websites and, depending on the bug, may lead to process crashes, memory disclosure, data corruption, or possible arbitrary code execution; unsupported **RHEL 6** packages containing affected WebKitGTK components should be assumed vulnerable.
Aug 31, 2026
Red Hat disclosed **CVE-2026-43742**, a moderate-severity use-after-free flaw in **WebKitGTK** caused by improper memory management when handling maliciously crafted web content. The bug can trigger an unexpected process crash and is tracked under **CWE-416** with a **CVSS v3.1 score of 6.5**; Red Hat noted that, in some circumstances, the weakness could also lead to memory corruption, memory disclosure, or potentially arbitrary code execution. The issue was addressed through improved memory management and aligns with Apple’s upstream description of the same vulnerability affecting WebKit-based platforms. Red Hat linked fixes for affected **Red Hat Enterprise Linux 7, 8, and 9** offerings to multiple `RHSA` advisories, while packages in **RHEL 6** containing `pywebkitgtk` and `webkitgtk` are out of support scope and should be assumed affected. The flaw is also referenced in **WebKitGTK Security Advisory `WSA-2026-0004`** and WebKit bug `315161`, and Apple’s CVE record says the same crafted-content issue affected Safari and several Apple operating systems before their respective patched versions.
Aug 24, 2026