Webkitgtk

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Webkitgtk product.

RSS Feeds for Webkitgtk security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Webkitgtk products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Webkitgtk Sorted by Most Security Vulnerabilities since 2018

Webkitgtk105 vulnerabilities

Webkitgtk Webkit2gtk31 vulnerability

Known Exploited Webkitgtk Vulnerabilities

The following Webkitgtk vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
WebKitGTK Memory Corruption Vulnerability	WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution. CVE-2019-8720 Exploit Probability: 7.8%	May 23, 2022

By the Year

In 2025 there have been 0 vulnerabilities in Webkitgtk. Last year, in 2024 Webkitgtk had 7 security vulnerabilities published. Right now, Webkitgtk is on track to have less security vulnerabilities in 2025 than it did last year.

Year	Vulnerabilities	Average Score
2025	0	0.00
2024	7	7.01
2023	19	8.43
2022	4	8.48
2021	14	7.19
2020	8	8.61
2019	14	7.61
2018	22	8.19

It may take a day or so for new Webkitgtk vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Webkitgtk Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-27834	May 14, 2024	Apple iOS/PiOS PointerAuth Bypass via Arbitrary RW (pre-17.5) The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.	Webkitgtk
CVE-2024-23246	Mar 08, 2024	Apple OS Sandbox Escape CVE-2024-23246 (pre macOS 14.4, iOS 17.4) This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An app may be able to break out of its sandbox.	Webkitgtk
CVE-2024-23254	Mar 08, 2024	Cross-Orig Audio Data Exfiltration via Safari UI Handling (before 17.4) The issue was addressed with improved UI handling. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, Safari 17.4. A malicious website may exfiltrate audio data cross-origin.	Webkitgtk
CVE-2024-23280	Mar 08, 2024	Safari Injection Fingerprinting Issue Fixed in v17.4 An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvOS 17.4. A maliciously crafted webpage may be able to fingerprint the user.	Webkitgtk
CVE-2024-23263	Mar 08, 2024	CVE-2024-23263 Safari CSP Bypass Improper Validation (17.4) A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.	Webkitgtk
CVE-2024-23284	Mar 08, 2024	Apple Safari Content Security Policy bypass, fixed in 17.4 A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.	Webkitgtk
CVE-2023-42843	Feb 21, 2024	Safari address bar spoofing via UI state laxity (CVE-2023-42843) An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visiting a malicious website may lead to address bar spoofing.	Webkitgtk
CVE-2023-42916	Nov 30, 2023	Apple iOS/iPadOS Safari OOB read (<16.7.1) fixed 17.1.2 An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.	Webkitgtk
CVE-2023-42917	Nov 30, 2023	Code Exec via WebKit Mem Corrupt before iOS 16.7.1, fixed Safari 17.1.2 A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.	Webkitgtk
CVE-2023-39928	Oct 06, 2023	Use-After-Free in WebKitGTK MediaRecorder API 2.40.5 A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.	Webkitgtk