CVE-2023-42843

An inconsistent user interface issue in WebKit and related components was addressed through improved state management. The vulnerability allows a malicious website to perform address bar spoofing , potentially misleading the user. This issue affects iOS 16.7.2, iPadOS 16.7.2, iOS 17.1, iPadOS 17....

CVE-2022-2294

CVE-2022-2294 is a heap-buffer-overflow in WebRTC code within Google Chrome (Chromium-based) prior to 103.0.5060.114. Reported as enabling remote heap corruption via a crafted HTML page, potentially leading to code execution. Affected component: WebRTC in Chrome/Chromium. Remediation: upgrade to ...

CVE-2019-8720

CVE-2019-8720 is a WebKit-based memory-corruption vulnerability affecting WebKitGTK/WebKit2GTK components. Public sources in the Connected Documents identify arbitrary-code-execution potential when processing malicious web content (WebKitGTK/WebKit2GTK). Debian’s security advisory lists CVE-2019-...

CVE-2022-32893

CVE-2022-32893 is an out-of-bounds write vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. The CVE is fixed in Apple products by updates: iOS 15.6.1 / iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. Connected advisories not...

CVE-2025-6558

CVE-2025-6558 involves insufficient validation of untrusted input in ANGLE and GPU within Google Chrome, enabling a remote attacker to potentially escape the sandbox via a crafted HTML page. Connected sources specify Chrome components ANGLE and GPU as affected, with the patch previously shipped i...

CVE-2020-11793

WebKitGTK/WebKit (WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1) are affected by CVE-2020-11793 due to a use-after-free in processing crafted web content, leading to arbitrary code execution or memory corruption and potential Denial of Service. Connected advisories indicate fixes in WebKit...

CVE-2020-10018

The CVE-2020-10018 entry concerns WebKitGTK and WPE WebKit memory corruption (use-after-free) in versions up to 2.26.4, with fix implemented in 2.28.0. Affected products/components: WebKitGTK and WPE WebKit before 2.28.0; root cause: use-after-free leading to arbitrary code execution on processin...

CVE-2019-11070

WebKitGTK/WebKitGTK4 (webkitgtk4) is affected by CVE-2019-11070. The issue arises from WebKitGTK and WPE WebKit prior to 2.24.1 failing to apply configured HTTP proxy settings when downloading livestream video (HLS/DASH/Smooth Streaming), leading to potential deanonymization. Remediation in the c...

CVE-2021-30952

CVE-2021-30952 is an Apple WebKit/WebKitGTK-affected integer overflow in processing malicious web content that can lead to arbitrary code execution. The issue is addressed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2, iPadOS 15.2, and watchOS 8.3, with fixes via input validation impro...

CVE-2019-6251

CVE-2019-6251 affects WebKitGTK and WPE WebKit prior to 2.24.1. The issue is address bar spoofing via certain JavaScript redirections that could cause malicious content to appear as if it were from a trusted URI. Publicly documented references in Debian/Ubuntu/RHEL ecosystems confirm the vulnerab...

CVE-2020-13753

The CVE-2020-13753 entry concerns the bubblewrap sandbox used by WebKitGTK and WPE WebKit. Connected sources (e.g., Debian DSA-4724-1) confirm that before version 2.28.3 the bubblewrap sandbox failed to block CLONE_NEWUSER and the TIOCSTI ioctl, enabling sandbox escape: CLONE_NEWUSER could allow ...

CVE-2023-28198

CVE-2023-28198: A use-after-free in WebKit processing web content was fixed. Affected: Apple platforms (iOS/iPadOS/macOS) as per the description. Impact stated: arbitrary code execution if exploited via processing web content. Root cause: memory management/use-after-free vulnerability. Remediatio...

CVE-2021-42762

CVE-2021-42762 affects WebKitGTK and WPE WebKit up to version 2.34.0 (fixed in 2.34.1). BubblewrapLauncher.cpp can enable a limited sandbox bypass, allowing a sandboxed process to trick host processes into thinking it is not confined by the sandbox by abusing VFS syscalls that manipulate the file...

CVE-2023-40397

CVE-2023-40397 is a documented WebKit/WebKitGTK+ related vulnerability. The connected documents indicate a remote attacker could cause arbitrary JavaScript code execution, with fixes implemented in macOS Ventura 13.5. The primary entry notes the issue was addressed with improved checks and is fix...

CVE-2024-27834

This vulnerability affects WebKit and its integrated components across multiple platforms, including Safari , iOS , iPadOS , macOS Sonoma , tvOS , and watchOS . The root cause is an issue in the WebKit engine that allows an attacker with arbitrary read and write capability to bypass Pointer Authe...

CVE-2023-32370

CVE-2023-32370 is a logic issue in WebKitGTK/WebKit CSP handling where the Content Security Policy may fail to block domains with wildcards. The vulnerability is documented as fixed in macOS Ventura 13.3 (CSP wildcard blocking), with related advisories referencing WebKitGTK/WebKit’s CSP logic. Af...

CVE-2024-23284

CVE-2024-23284 concerns a logic issue in WebKitGTK/WebKit rendering where processing maliciously crafted web content may prevent Content Security Policy (CSP) from being enforced. The connected sources show the same vulnerability across multiple distributions (e.g., Debian webkit2gtk advisories a...

CVE-2024-23280

An injection issue exists in the WebKit engine, specifically affecting Safari , iOS , iPadOS , macOS Sonoma , tvOS , watchOS , and webkitgtk4 / webkit2gtk components. The root cause is insufficient validation, which could allow a maliciously crafted webpage to fingerprint the user . Remediation i...

CVE-2024-23263

A logic issue was identified in the WebKit engine (specifically affecting WebKitGTK , WPE WebKit , and webkitgtk4 ) where processing maliciously crafted web content could prevent Content Security Policy from being enforced. The vulnerability was addressed with improved validation . This issue is ...

CVE-2024-23254

CVE-2024-23254 concerns WebKit/WebKitGTK components where a malicious website could exfiltrate audio data cross-origin. The initial entry notes the issue is fixed in Apple platforms: tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4, iPadOS 17.4, watchOS 10.4, and Safari 17.4. Public disclosur...

CVE-2025-31277

A buffer overflow vulnerability exists in WebKit due to improper memory handling, which may lead to memory corruption when processing maliciously crafted web content. This flaw affects multiple Apple products, including Safari , iOS , iPadOS , macOS Sequoia , tvOS , visionOS , and watchOS . The v...

CVE-2025-43343

The WebKitGTK web engine (including WPE WebKit ) is vulnerable to a memory handling issue where processing maliciously crafted web content can lead to an unexpected process crash . The vulnerability is also present in Safari , iOS , iPadOS , macOS Tahoe , tvOS , visionOS , and watchOS systems. Re...

CVE-2018-12293

CVE-2018-12293 affects WebKitGTK+ and WPE WebKit: getImageData in ImageBufferCairo.cpp can overflow a heap due to integer overflow when computing image data size. Affected versions: WebKitGTK+ < 2.20.3 and WPE WebKit

CVE-2025-43342

A correctness issue in the WebKit engine, specifically within the webkitgtk and webkitgtk4 components, allows an attacker to cause an unexpected process crash by processing maliciously crafted web content. This vulnerability affects several platforms, including Safari (version 26), iOS (18.7 and ...