WebKitGTK Use-After-Free Flaw Lets Malicious Web Content Crash Processes

Apple and Red Hat disclosed CVE-2026-43663, a moderate-severity CWE-416 use-after-free flaw in WebKit/WebKitGTK caused by improper memory handling when processing maliciously crafted web content. The vulnerability can be triggered over the network with low attack complexity and no privileges, but it requires user interaction; vendors say successful exploitation can cause an unexpected process crash, creating a denial-of-service condition and potentially broader memory-corruption risks in some scenarios.

Apple said it fixed the issue across Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS, while Red Hat reported remediation for multiple RHEL 7, 8, and 9 product streams through security errata and related Bugzilla tracking. Red Hat assigned the flaw a CVSS v3 score of 6.5 and noted that some older RHEL 6 packages containing affected components fall outside support scope; the fix was described as improved memory handling in WebKitGTK.