WebKitGTK Use-After-Free Flaw Can Crash Processes via Malicious Web Content
Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Jul 14, 2026
Red Hat disclosed CVE-2026-43742, a moderate-severity use-after-free flaw in WebKitGTK caused by improper memory management when handling maliciously crafted web content. The bug can trigger an unexpected process crash and is tracked under CWE-416 with a CVSS v3.1 score of 6.5; Red Hat noted that, in some circumstances, the weakness could also lead to memory corruption, memory disclosure, or potentially arbitrary code execution. The issue was addressed through improved memory management and aligns with Apple’s upstream description of the same vulnerability affecting WebKit-based platforms.
Red Hat linked fixes for affected Red Hat Enterprise Linux 7, 8, and 9 offerings to multiple RHSA advisories, while packages in RHEL 6 containing pywebkitgtk and webkitgtk are out of support scope and should be assumed affected. The flaw is also referenced in WebKitGTK Security Advisory WSA-2026-0004 and WebKit bug 315161, and Apple’s CVE record says the same crafted-content issue affected Safari and several Apple operating systems before their respective patched versions.
