Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

WebKitGTK can let attackers corrupt memory

CVE-2026-78376 · published 2 months ago
Summary

WebKitGTK, used in several Ubuntu and Linux applications, may mishandle data from a malicious website, causing the program to use memory that has already been released. This can lead to memory corruption and potentially allow an attacker to run unwanted code. Update to the latest WebKitGTK packages or apply vendor patches to protect your systems.

What to do
  • Update webkit2gtk to version 2.52.6-1~deb13u1.aikido.1.
  • Update rootio-webkit2gtk to version 2.52.6-1~deb13u1.aikido.1.
  • Update debian webkit2gtk to version 2.54.0-1~deb13u1.
  • Update debian wpewebkit to version 2.54.0-1.
  • Update webkit webkit to version * or later.
  • Update webkitgtk webkitgtk to version * or later.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:16.04:LTS canonical qtwebkit-opensource-src All versions
Ubuntu:16.04:LTS canonical webkit2gtk All versions
Ubuntu:16.04:LTS canonical qtwebkit-source All versions
Ubuntu:16.04:LTS canonical webkitgtk All versions
Ubuntu:20.04:LTS canonical wpewebkit All versions
Debian:11 debian webkit2gtk All versions
Debian:12 debian webkit2gtk All versions
Debian:13 debian webkit2gtk < 2.54.0-1~deb13u1
Fix: upgrade to 2.54.0-1~deb13u1
Debian:14 debian webkit2gtk All versions
Debian:11 debian wpewebkit All versions
Debian:12 debian wpewebkit All versions
Debian:13 debian wpewebkit All versions
Debian:14 debian wpewebkit < 2.54.0-1
Fix: upgrade to 2.54.0-1
– webkit webkit < *
– red hat red hat enterprise linux 6 All versions
– red hat red hat enterprise linux 7 All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 9 All versions
– webkitgtk webkitgtk < *
Root:Debian:13 – webkit2gtk < 2.52.6-1~deb13u1.aikido.1
Fix: upgrade to 2.52.6-1~deb13u1.aikido.1
Root:Debian:13 – rootio-webkit2gtk < 2.52.6-1~deb13u1.aikido.1
Fix: upgrade to 2.52.6-1~deb13u1.aikido.1
– red hat red hat enterprise linux 9.6 extended update support All versions
– red hat red hat enterprise linux 9.2 update services for sap solutions All versions
– red hat red hat enterprise linux 7 extended lifecycle support All versions
– red hat red hat enterprise linux 8.6 extended update support long-life add-on All versions
– red hat red hat enterprise linux 8.6 advanced mission critical update support All versions
– red hat red hat enterprise linux 9.4 update services for sap solutions All versions
– red hat red hat enterprise linux 8.8 telecommunications update service All versions
– red hat red hat enterprise linux 8.8 update services for sap solutions All versions
Original advisory text
Webkitgtk: use-after-free of jscvalue function parameters
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published24 Aug 2026
Updated5 Nov 2026
First seen24 Aug 2026
Sources
CVE-2026-78376 · NVD
CVE-2026-78376 · MITRE
DEBIAN-CVE-2026-78376 · OSV
UBUNTU-CVE-2026-78376 · OSV
ROOT-OS-DEBIAN-13-CVE-2026-78376 · OSV
Track software like this
Free during beta