endpoint-software-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-release

WebKitGTK Use-After-Free Flaw Can Crash Browsers via Malicious Web Content

Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Jul 14, 2026

Apple and Red Hat disclosed CVE-2026-43720, a use-after-free vulnerability in WebKit and WebKitGTK that can be triggered when a user processes maliciously crafted web content. The flaw, mapped to CWE-416, stems from improper memory management and can cause an unexpected browser or process crash, including Safari crashes on Apple platforms. Red Hat rated the issue moderate with a CVSS v3.1 score of 6.5, noting that exploitation requires user interaction and primarily affects availability.

Fixes were released across Apple products including Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, while Red Hat published remediation for affected WebKitGTK packages in multiple Red Hat Enterprise Linux 7, 8, and 9 offerings. Red Hat said RHEL 6 packages are outside support scope and should be assumed affected, and linked the issue to WebKit advisory WSA-2026-0004 and upstream bug 313175.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jun 29, 2026 – Jul 14, 2026

Jul 14, 20264mo ago
Red Hat opens Bugzilla bug 2500530 for CVE-2026-43720
Red Hat tracked CVE-2026-43720 as Bugzilla bug 2500530 under its Security Response product. The bug classified the WebKitGTK flaw as a medium-severity, medium-priority vulnerability on Linux.
2500530 - (CVE-2026-43720) CVE-2026-43720 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash
Jul 10, 20264mo ago
Red Hat publishes CVE-2026-43720 entry
Red Hat published its CVE-2026-43720 entry, rating the WebKitGTK use-after-free vulnerability as Moderate severity with a CVSS v3.1 score of 6.5. Red Hat also listed fixed RHEL 7, 8, and 9 offerings and marked certain RHEL 6 packages as out of support scope.
CVE-2026-43720 - Red Hat Customer Portal
Reported Jun 29, 20264mo ago
Apple updates the CVE-2026-43720 record
The CVE record for CVE-2026-43720 was updated after its initial publication. The record continued to reference fixes across Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS.
CVE Record: CVE-2026-43720
Jun 29, 20264mo ago
Apple publishes CVE-2026-43720 record
Apple published CVE-2026-43720, describing a use-after-free issue in WebKit processing of maliciously crafted web content that can cause an unexpected Safari crash. The record notes the issue was addressed through improved memory management.
CVE Record: CVE-2026-43720

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Use-after-free denial of service in WebKit (CVE-2026-43720)

Affected products

2 linked

SafariWebkitgtk

Organizations

2 linked

Red HatApple

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Redhat OtherNews · Aug 24, 2026

CVE-2026-43720 - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · Jul 20, 2026

2500530 - (CVE-2026-43720) CVE-2026-43720 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crashOpen source ↗

CveAdvisories · Jun 29, 2026

CVE Record: CVE-2026-43720Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News