Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

WebKitGTK can let malicious pages corrupt memory

published 1 month ago
Summary

The WebKitGTK component used on GTK 3 systems may mishandle specially crafted web content, leading to memory corruption. An attacker who tricks a user into visiting a malicious page could cause the application to crash or behave unexpectedly. Update WebKitGTK to the latest version provided by your distribution to protect against this risk.

What to do
  • Update openeuler webkitgtk to version webkit2gtk5.0-2.38.2-15.oe2403sp3.
Affected software
Ecosystem VendorProductAffected versions
openEuler:24.03-LTS-SP3 openeuler webkitgtk < webkit2gtk5.0-2.38.2-15.oe2403sp3
Fix: upgrade to webkit2gtk5.0-2.38.2-15.oe2403sp3
Original advisory text
webkitgtk security update
WebKitGTK is the port of the WebKit web rendering engine to the GTK platform. This package contains WebKitGTK for GTK 3 and libsoup 3.

Security Fix(es):

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.(CVE-2026-78376)

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. The vulnerability exists in the findFeature function of OpenTypeVerticalData, which fails to properly validate the full featurelist array.(CVE-2026-83596)
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Timeline
Published20 Sep 2026
Updated20 Sep 2026
First seen20 Sep 2026
Sources
OESA-2026-3935 · OSV
Track software like this
Free during beta