Webkit vulnerabilities
12 vulnerabilities
Known vulnerabilities in Webkit products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Webkit7 vulnerabilities
- Webkitgtk\+5 vulnerabilities
- Javascriptcore0 vulnerabilities
CVE-2018-4209appleicloud+12
EPSS score2.06%
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.CVE-2018-12294debianwebkit2gtk+5EPSS score2.42%
WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object.CVE-2016-9642ubuntuqtwebkit-opensource-src+4EPSS score1.27%
JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file.CVE-2016-9643ubuntuqtwebkit-opensource-src+4EPSS score3.07%
The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis).CVE-2020-9948applesafari+9EPSS score1.69%
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.CVE-2020-9951appleicloud+15EPSS score2.33%
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.CVE-2020-9952appleicloud+16EPSS score1.50%
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.CVE-2010-1766digiaqt+1EPSS score2.25%
Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products, allows remote websockets servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an upgrade header that is long and invalid.CVE-2009-3933webkitwebkitEPSS score3.10%
WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via a web page that calls the JavaScript setInterval method, which triggers an incompatibility between the WTF::currentTime and base::Time functions.CVE-2026-83596debianwebkit2gtk+4EPSS score0.29%
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.CVE-2026-78376debianwebkit2gtk+8EPSS score0.29%
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.CVE-2023-39928debianwebkit2gtk+10EPSS score1.45%
A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.