Loading story…
WebKitGTK and WPE WebKit published security advisory WSA-2026-0005 disclosing nine vulnerabilities across multiple releases of the browser engine, including memory handling errors, out-of-bounds access, use-after-free bugs, permissions validation issues, state management problems, privacy leakage, denial-of-service, UI spoofing, and an iframe sandbox policy bypass. The affected issues are tracked as CVE-2026-28984, CVE-2026-43804, CVE-2026-64713, CVE-2026-64719, CVE-2026-64728, CVE-2026-64730, CVE-2026-64757, CVE-2026-64783, and CVE-2026-64787, with fixes delivered in versions 2.52.4, 2.52.5, and 2.52.6 depending on the flaw.
One of the patched bugs, CVE-2026-64783, is a WebKit use-after-free that Apple said could crash devices when processing malicious web content. Apple included the issue in security updates for macOS Tahoe 26.6 and iOS/iPadOS 26.6, and explicitly credited GLM from Z.AI as the accepted reporter, highlighting a case where an AI model was named in vulnerability discovery attribution. Organizations using WebKit-based components on Linux and Apple platforms have been urged to update to the latest stable releases.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On August 20, 2026, WebKitGTK and WPE WebKit published security advisory WSA-2026-0005 disclosing nine vulnerabilities, including CVE-2026-64783. The advisory said affected releases were versions before 2.52.4, 2.52.5, or 2.52.6 depending on the CVE, and recommended updating to the latest stable versions.
Apple disclosed CVE-2026-64783 as a WebKit use-after-free vulnerability that could cause a crash when processing malicious web content. Apple’s accepted reporter credit explicitly named GLM from Z.AI, with the finding shared with other researchers, and Apple published security content for macOS Tahoe 26.6 and iOS/iPadOS 26.6 referencing the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WebKitGTK and WPE WebKit released security advisory **WSA-2026-0002** addressing eight vulnerabilities in versions before **2.52.1**, including a **Same Origin Policy bypass**, a **Content Security Policy enforcement bypass**, cross-origin access to script message handlers, cross-site scripting, user fingerprinting, and flaws tied to restricted content processing that could affect sandbox boundaries. The advisory also lists multiple memory-handling issues that can trigger crashes, broadening the impact beyond web security policy failures to application stability and potential exploitation risk. The issues are tracked as `CVE-2026-20643`, `CVE-2026-20664`, `CVE-2026-20665`, `CVE-2026-20691`, `CVE-2026-28857`, `CVE-2026-28859`, `CVE-2026-28861`, and `CVE-2026-28871`. Debian separately published **DSA-6172-1** for `webkit2gtk`, indicating downstream distribution updates are being issued to ship the fixes. Organizations using WebKitGTK-based browsers or embedded web views, as well as WPE WebKit deployments, should update to **2.52.1** or the corresponding vendor-patched packages to remediate the disclosed vulnerabilities.
Jun 29, 2026
Apple and Red Hat disclosed **CVE-2026-43663**, a moderate-severity `CWE-416` use-after-free flaw in WebKit/WebKitGTK caused by improper memory handling when processing maliciously crafted web content. The vulnerability can be triggered over the network with low attack complexity and no privileges, but it requires user interaction; vendors say successful exploitation can cause an unexpected process crash, creating a denial-of-service condition and potentially broader memory-corruption risks in some scenarios. Apple said it fixed the issue across Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, while Red Hat reported remediation for multiple **RHEL 7, 8, and 9** product streams through security errata and related Bugzilla tracking. Red Hat assigned the flaw a **CVSS v3 score of 6.5** and noted that some older **RHEL 6** packages containing affected components fall outside support scope; the fix was described as improved memory handling in WebKitGTK.
Aug 24, 2026
Apple released security updates for **Safari, iOS, iPadOS, and macOS** to fix more than 30 vulnerabilities, including the high-severity Safari/WebKit flaw **`CVE-2026-43715`**, a remotely exploitable use-after-free bug triggered by maliciously crafted web content. Apple said the issue could lead to memory corruption and addressed it with improved memory management in **Safari 26.5.2**, **iOS 26.5.2**, **iPadOS 26.5.2**, and **macOS Tahoe 26.5.2**; the flaw carries a **CVSS 8.8** rating. The broader patch set also remediates additional WebKit and kernel vulnerabilities that could cause crashes, sensitive data exposure, sandbox escape, and kernel memory corruption. Apple said none of the flaws were known to be exploited in the wild, but it is accelerating patch delivery because AI-assisted research may shorten the gap between vulnerability discovery and weaponization; several of the WebKit bugs were identified with help from **OpenAI Codex Security** and researchers using **Anthropic Claude**.
Aug 24, 2026