Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

WebKitGTK browsers may crash when viewing malicious web pages

CVE-2026-28955 · published 5 months ago
Summary

The WebKitGTK rendering engine used in several Linux browsers and Apple's iPadOS can crash if it processes specially crafted web content. This could cause the application to stop working unexpectedly, affecting user experience. Update to the latest versions provided by your operating system or browser vendor to apply the fix.

What to do
  • Update canonical webkit2gtk to version 2.52.6-0ubuntu0.24.04.1.
  • Update canonical webkit2gtk to version 2.52.6-0ubuntu0.26.04.1.
  • Update debian webkit2gtk to version 2.52.5-1~deb13u1.
  • Update debian webkit2gtk to version 2.52.4-1.
  • Update debian wpewebkit to version 2.52.4-1.
  • Update webkit2gtk to version 2.50.6-1~deb12u2.aikido.5.
  • Update rootio-webkit2gtk to version 2.50.6-1~deb12u2.aikido.5.
  • Update webkit2gtk to version 2.50.6-1~deb12u2.aikido.6.
  • Update rootio-webkit2gtk to version 2.50.6-1~deb12u2.aikido.6.
  • Update webkit2gtk to version 2.50.6-1~deb12u2.aikido.7.
  • Update rootio-webkit2gtk to version 2.50.6-1~deb12u2.aikido.7.
  • Update apple macos to version 26.5 or later.
  • Update apple tvos to version 26.5 or later.
  • Update apple visionos to version 26.5 or later.
  • Update apple watchos to version 26.5 or later.
  • Update apple safari to version 26.5 or later.
  • Update apple ios and ipados to version 18.7.9 or later.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:18.04:LTS canonical webkitgtk All versions
Ubuntu:20.04:LTS canonical webkit2gtk All versions
Ubuntu:20.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:20.04:LTS canonical wpewebkit All versions
Ubuntu:22.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:22.04:LTS canonical webkit2gtk All versions
Ubuntu:22.04:LTS canonical wpewebkit All versions
Ubuntu:24.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:24.04:LTS canonical webkit2gtk < 2.52.6-0ubuntu0.24.04.1
Fix: upgrade to 2.52.6-0ubuntu0.24.04.1
Ubuntu:26.04:LTS canonical webkit2gtk < 2.52.6-0ubuntu0.26.04.1
Fix: upgrade to 2.52.6-0ubuntu0.26.04.1
– apple ipados < 18.7.9
>= 26.0, < 26.5
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
– apple iphone_os < 18.7.9
>= 26.0, < 26.5
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
– apple macos >= 26.0, < 26.5
< 26.5
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
– apple tvos < 26.5
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
– apple visionos < 26.5
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
– apple watchos < 26.5
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
– apple safari < 26.5
– apple ios and ipados < 18.7.9
Debian:11 debian webkit2gtk All versions
Debian:12 debian webkit2gtk All versions
Debian:13 debian webkit2gtk < 2.52.5-1~deb13u1
Fix: upgrade to 2.52.5-1~deb13u1
Debian:14 debian webkit2gtk < 2.52.4-1
Fix: upgrade to 2.52.4-1
Debian:11 debian wpewebkit All versions
Debian:12 debian wpewebkit All versions
Debian:13 debian wpewebkit All versions
Debian:14 debian wpewebkit < 2.52.4-1
Fix: upgrade to 2.52.4-1
Ubuntu:16.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:16.04:LTS canonical webkit2gtk All versions
Ubuntu:16.04:LTS canonical qtwebkit-source All versions
Ubuntu:16.04:LTS canonical webkitgtk All versions
Ubuntu:18.04:LTS canonical webkit2gtk All versions
Ubuntu:18.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:18.04:LTS canonical qtwebkit-source All versions
Root:Debian:12 – webkit2gtk < 2.50.6-1~deb12u2.aikido.5
< 2.50.6-1~deb12u2.aikido.6
< 2.50.6-1~deb12u2.aikido.7
Fix: upgrade to 2.50.6-1~deb12u2.aikido.5
Root:Debian:12 – rootio-webkit2gtk < 2.50.6-1~deb12u2.aikido.5
< 2.50.6-1~deb12u2.aikido.6
< 2.50.6-1~deb12u2.aikido.7
Fix: upgrade to 2.50.6-1~deb12u2.aikido.5
Original advisory text
CVE-2026-28955 in webkit2gtk - Patched by Root
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-120Classic Buffer Overflow
Timeline
Published11 May 2026
Updated4 Nov 2026
First seen11 May 2026
Sources
UBUNTU-CVE-2026-28955 · OSV
CVE-2026-28955 · NVD
CVE-2026-28955 · MITRE
DEBIAN-CVE-2026-28955 · OSV
ROOT-OS-DEBIAN-12-CVE-2026-28955 · OSV
Track software like this
Free during beta