Loading vulnerability…
Use-after-free in WebKitGTK JSCValue function parameters
CVE-2026-78376 is a use-after-free vulnerability in WebKitGTK involving JSCValue function parameters. Improper memory handling when processing malicious web content can cause memory corruption. Exploitation generally requires a user to load attacker-controlled content in an application using vulnerable WebKitGTK libraries, although the GNOME Shell integration may expose the vulnerability to local-network attackers without user interaction. Remote code execution is a potential consequence but is not confirmed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt memory in the affected WebKitGTK-based application, potentially causing application crashes or denial of service. Remote code execution cannot be ruled out. The assigned CVSS v3.1 score of 8.8 reflects potentially high confidentiality, integrity, and availability impacts; it does not establish that arbitrary code execution has been demonstrated.
If you can’t patch tonight, do this now.
Avoid loading or processing untrusted web content in applications using WebKitGTK until patched. Remove vulnerable WebKitGTK packages where operationally feasible, after reviewing dependencies: removing WebKitGTK4-dependent packages on RHEL 7 may also remove GNOME components and disrupt desktop functionality. Application sandboxing, least-privilege controls, and reduced exposure to untrusted content can limit risk but do not fix the vulnerability.
Patch, then assume compromise.
Install vendor-provided WebKitGTK and JavaScriptCore security updates containing the fix, included in WebKitGTK 2.54.0. Identified fixed distribution builds include webkit2gtk 2.54.0-1~deb13u1 and RHEL 9 webkit2gtk3 2.54.0-1.el9_8. Apply the corresponding updates for other affected distributions and update applications that bundle WebKitGTK. Account for vendor backports rather than relying solely on the upstream version number.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.