WebKitGTK Use-After-Free Flaw Exposes RHEL Systems to Possible Remote Code Execution
Vulnerability Disclosure · 5 sources · Updated 2mo ago · First seen Aug 24, 2026
Red Hat disclosed CVE-2026-78376, an Important-severity use-after-free vulnerability in WebKitGTK that can be triggered when a target processes maliciously crafted web content. The memory-handling flaw can cause memory corruption and may lead to remote code execution, with Red Hat assigning a CVSS v3.1 score of 8.8. Red Hat said exploitation typically requires a user to load untrusted content, but warned that in gnome-shell the issue may be reachable from the local network without user interaction.
Affected products include packages in Red Hat Enterprise Linux 7, 8, and 9, while RHEL 6 is outside support scope. Red Hat’s bug tracker said the issue was remediated through improved memory handling, and noted that Apple platforms are not affected. The vendor advised organizations to reduce exposure by avoiding untrusted web content and, where operationally feasible, removing vulnerable WebKitGTK packages until patched updates are applied.
