Webkitgtk Webkitgtk

  1. Vendors
  2. Webkitgtk

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Webkitgtk product.

Products by Webkitgtk Sorted by Most Security Vulnerabilities since 2018

Webkitgtk104 vulnerabilities

Webkitgtk Webkit2gtk31 vulnerability

Known Exploited Webkitgtk Vulnerabilities

The following Webkitgtk vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title Description Added
WebKitGTK Memory Corruption Vulnerability WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.
CVE-2019-8720 Exploit Probability: 13.5% 		May 23, 2022

By the Year

In 2025 there have been 0 vulnerabilities in Webkitgtk. Last year, in 2024 Webkitgtk had 6 security vulnerabilities published. Right now, Webkitgtk is on track to have less security vulnerabilities in 2025 than it did last year.




Year Vulnerabilities Average Score
2025 0 0.00
2024 6 5.97
2023 19 8.43
2022 4 8.48
2021 14 7.19
2020 8 8.61
2019 14 7.61
2018 22 8.19

It may take a day or so for new Webkitgtk vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Webkitgtk Security Vulnerabilities

The issue was addressed with improved checks

CVE-2024-27834 5.5 - Medium - May 14, 2024

The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

A logic issue was addressed with improved state management

CVE-2024-23284 6.5 - Medium - March 08, 2024

A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

A logic issue was addressed with improved validation

CVE-2024-23263 6.5 - Medium - March 08, 2024

A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

An injection issue was addressed with improved validation

CVE-2024-23280 6.5 - Medium - March 08, 2024

An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. A maliciously crafted webpage may be able to fingerprint the user.

Injection

The issue was addressed with improved UI handling

CVE-2024-23254 6.5 - Medium - March 08, 2024

The issue was addressed with improved UI handling. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, Safari 17.4. A malicious website may exfiltrate audio data cross-origin.

An inconsistent user interface issue was addressed with improved state management

CVE-2023-42843 4.3 - Medium - February 21, 2024

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing.

Authentication Bypass by Spoofing

A memory corruption vulnerability was addressed with improved locking

CVE-2023-42917 8.8 - High - November 30, 2023

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Memory Corruption

An out-of-bounds read was addressed with improved input validation

CVE-2023-42916 6.5 - Medium - November 30, 2023

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

Out-of-bounds Read

A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5

CVE-2023-39928 8.8 - High - October 06, 2023

A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.

Dangling pointer

The issue was addressed with improved checks

CVE-2023-41993 8.8 - High - September 21, 2023

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Improper Check for Unusual or Exceptional Conditions

The issue was addressed with improved checks

CVE-2023-40397 9.8 - Critical - September 06, 2023

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution.

A logic issue was addressed with improved validation

CVE-2023-32370 5.3 - Medium - September 06, 2023

A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fail.

A use-after-free issue was addressed with improved memory management

CVE-2023-28198 8.8 - High - August 14, 2023

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution.

Dangling pointer

The issue was addressed with improved checks

CVE-2023-37450 8.8 - High - July 27, 2023

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

A use-after-free issue was addressed with improved memory management

CVE-2023-32373 8.8 - High - June 23, 2023

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Dangling pointer

A type confusion issue was addressed with improved checks

CVE-2023-32439 8.8 - High - June 23, 2023

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Object Type Confusion

An out-of-bounds read was addressed with improved input validation

CVE-2023-28204 6.5 - Medium - June 23, 2023

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.

Out-of-bounds Read

A flaw was found in the WebKitGTK package

CVE-2023-2203 8.8 - High - May 17, 2023

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Dangling pointer

A vulnerability was found in WebKit

CVE-2019-8720 8.8 - High - March 06, 2023

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

Buffer Overflow

A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8

CVE-2023-25363 8.8 - High - March 02, 2023

A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execute code remotely.

Dangling pointer

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.