Skip to content
Heist/ feed
HighFix available

webkitgtk security update

Type: advisorySource: OSV1 source record

WebKitGTK is the port of the WebKit web rendering engine to the GTK platform. This package contains WebKitGTK for GTK 3 and libsoup 3. Security Fix(es): A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.(CVE-2026-78376) A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. The vulnerability exists in the findFeature function of OpenTypeVerticalData, which fails to properly validate the full featurelist array.(CVE-2026-83596)

Announced Source revision 1
Original source ↗

OESA-2026-4015

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4015

webkitgtk

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
webkitgtk6.0-2.50.6-5.oe2403sp4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "webkitgtk6.0-2.50.6-5.oe2403sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "webkitgtk",
      "purl": "pkg:rpm/openEuler/webkitgtk&distro=openEuler-24.03-LTS-SP4",
      "ecosystem": "openEuler:24.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4015.json"
    },
    "ecosystem_specific": {
      "src": [
        "webkit2gtk4.1-2.50.6-5.oe2403sp4.src.rpm",
        "webkitgtk-2.50.6-5.oe2403sp4.src.rpm",
        "webkitgtk6.0-2.50.6-5.oe2403sp4.src.rpm"
      ],
      "noarch": [
        "webkit2gtk4.0-help-2.50.6-5.oe2403sp4.noarch.rpm",
        "webkit2gtk4.1-help-2.50.6-5.oe2403sp4.noarch.rpm",
        "webkitgtk6.0-help-2.50.6-5.oe2403sp4.noarch.rpm"
      ],
      "x86_64": [
        "jsc4.0-2.50.6-5.oe2403sp4.x86_64.rpm",
        "jsc4.0-devel-2.50.6-5.oe2403sp4.x86_64.rpm",
        "jsc4.1-2.50.6-5.oe2403sp4.x86_64.rpm",
        "jsc4.1-devel-2.50.6-5.oe2403sp4.x86_64.rpm",
        "jsc6.0-2.50.6-5.oe2403sp4.x86_64.rpm",
        "jsc6.0-devel-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkit2gtk4.0-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkit2gtk4.0-devel-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkit2gtk4.1-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkit2gtk4.1-debuginfo-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkit2gtk4.1-debugsource-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkit2gtk4.1-devel-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkitgtk-debuginfo-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkitgtk-debugsource-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkitgtk6.0-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkitgtk6.0-debuginfo-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkitgtk6.0-debugsource-2.50.6-5.oe2403sp4.x86_64.rpm",
        "webkitgtk6.0-devel-2.50.6-5.oe2403sp4.x86_64.rpm"
      ],
      "aarch64": [
        "jsc4.0-2.50.6-5.oe2403sp4.aarch64.rpm",
        "jsc4.0-devel-2.50.6-5.oe2403sp4.aarch64.rpm",
        "jsc4.1-2.50.6-5.oe2403sp4.aarch64.rpm",
        "jsc4.1-devel-2.50.6-5.oe2403sp4.aarch64.rpm",
        "jsc6.0-2.50.6-5.oe2403sp4.aarch64.rpm",
        "jsc6.0-devel-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkit2gtk4.0-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkit2gtk4.0-devel-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkit2gtk4.1-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkit2gtk4.1-debuginfo-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkit2gtk4.1-debugsource-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkit2gtk4.1-devel-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkitgtk-debuginfo-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkitgtk-debugsource-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkitgtk6.0-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkitgtk6.0-debuginfo-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkitgtk6.0-debugsource-2.50.6-5.oe2403sp4.aarch64.rpm",
        "webkitgtk6.0-devel-2.50.6-5.oe2403sp4.aarch64.rpm"
      ]
    }
  }
]

Publisher severity

high

Source reference: /database_specific/severity

Event
#14652 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement