# CVE-2023-43000: webkit2gtk3: This update for webkit2gtk3 fixes the following issues: Update to version 2.50.4. Security issues fixed: - CVE-202... CVE-2023-43000 is fixed in 22 products on 1 platform, first by RHSA-2024:2126, released April 30, 2024. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on March 5, 2026. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/cve/CVE-2023-43000 - Priority: Patch now - CVSS: 8.8 (high) - EPSS: 0.0404 - CISA KEV: listed Mar 5, 2026, federal due date Mar 26, 2026 - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 30, 2024 ## Description This update for webkit2gtk3 fixes the following issues: Update to version 2.50.4. Security issues fixed: - CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead to a UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208). - CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to a lack of verification of the origins of drag operations (bsc#1254473). - CVE-2025-14174: processing maliciously crafted web content may lead to memory corruption due to improper validation (bsc#1255497). - CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling (bsc#1254165). - CVE-2025-43421: processing maliciously crafted web content may lead to an unexpected process crash due to enabled array allocation sinking (bsc#1254167). - CVE-2025-43425: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1254168). - CVE-2025-43427: processing maliciously crafted web content may lead to an unexpected process crash due to issues with state management (bsc#1254169). - CVE-2025-43429: processing maliciously crafted web content may lead to an unexpected process crash due to a buffer overflow issue (bsc#1254174). - CVE-2025-43430: processing maliciously crafted web content may lead to an unexpected process crash due to issues with state management (bsc#1254172). - CVE-2025-43431: processing maliciously crafted web content may lead to memory corruption due to improper memory handling (bsc#1254170). - CVE-2025-43432: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after-free issue (bsc#1254171). - CVE-2025-43434: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after-free issue (bsc#1254179). - CVE-2025-43440: processing maliciously crafted web content may lead to an unexpected process crash due to missing checks (bsc#1254177). - CVE-2025-43443: processing maliciously crafted web content may lead to an unexpected process crash due to missing checks (bsc#1254176). - CVE-2025-43458: processing maliciously crafted web content may lead to an unexpected process crash due to issues with state management (bsc#1254498). - CVE-2025-43501: processing maliciously crafted web content may lead to an unexpected process crash due to a buffer overflow issue (bsc#1255194). - CVE-2025-43529: processing maliciously crafted web content may lead to arbitrary code execution due to a use-after-free issue (bsc#1255198). - CVE-2025-43531: processing maliciously crafted web content may lead to an unexpected process crash due to a race condition (bsc#1255183). - CVE-2025-43535: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1255195). - CVE-2025-43536: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after-free issue (bsc#1255200). - CVE-2025-43541: processing maliciously crafted web content may lead to an unexpected process crash due to type confusion (bsc#1255191). - CVE-2025-66287: processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling (bsc#1254509). Other issues fixed and changes: - Version 2.50.4: * Correctly handle the program name passed to the sleep disabler. * Ensure GStreamer is initialized before using the Quirks. * Fix several crashes and rendering issues. - Version 2.50.3: * Fix seeking and looping of media elements that set the 'loop' property. * Fix several crashes and rendering issues. - Version 2.50.2: * Prevent unsafe URI schemes from participating in media playback. * Make jsc_value_array_buffer_get_data() function introspectable. * Fix logging in to Google accounts that have a WebAuthn second factor configured. * Fix loading webkit://gpu when there are no threads configured for GPU rendering. * Fix rendering gradiants that use the CSS hue interpolation method. * Fix pasting image data from the clipboard. * Fix font-family selection when the font name contains spaces. * Fix the build with standard C libraries that lack execinfo.h, like Musl or uClibc. * Fix capturing canvas snapshots in the Web Inspector. * Fix several crashes and rendering issues. - Fix a11y regression where AT-SPI roles were mapped incorrectly. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | gir1.2-javascriptcoregtk-4.0 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [gir1.2-javascriptcoregtk-4.0 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gir1.2-javascriptcoregtk-4.0-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | gir1.2-javascriptcoregtk-4.1 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [gir1.2-javascriptcoregtk-4.1 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gir1.2-javascriptcoregtk-4.1-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | gir1.2-javascriptcoregtk-6.0 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [gir1.2-javascriptcoregtk-6.0 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gir1.2-javascriptcoregtk-6.0-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | gir1.2-webkit-6.0 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [gir1.2-webkit-6.0 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gir1.2-webkit-6.0-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | gir1.2-webkit2-4.0 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [gir1.2-webkit2-4.0 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gir1.2-webkit2-4.0-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | gir1.2-webkit2-4.1 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [gir1.2-webkit2-4.1 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-gir1.2-webkit2-4.1-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | libjavascriptcoregtk-4.0-18 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [libjavascriptcoregtk-4.0-18 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libjavascriptcoregtk-4.0-18-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | libjavascriptcoregtk-4.0-bin Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [libjavascriptcoregtk-4.0-bin 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libjavascriptcoregtk-4.0-bin-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | libjavascriptcoregtk-4.1-0 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [libjavascriptcoregtk-4.1-0 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libjavascriptcoregtk-4.1-0-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | libjavascriptcoregtk-6.0-1 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [libjavascriptcoregtk-6.0-1 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libjavascriptcoregtk-6.0-1-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | libwebkit2gtk-4.0-37 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [libwebkit2gtk-4.0-37 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebkit2gtk-4.0-37-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | libwebkit2gtk-4.1-0 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [libwebkit2gtk-4.1-0 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebkit2gtk-4.1-0-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | libwebkitgtk-6.0-4 Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [libwebkitgtk-6.0-4 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebkitgtk-6.0-4-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | webkit2gtk Debian 12.15 (bookworm) | 2.42.1-1~deb12u1 | [DEBIAN-CVE-2023-43000](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43000.md) | Nov 5, 2025 | | Linux | webkit2gtk Debian 13.5 (trixie) | 2.42.0-1 | [DEBIAN-CVE-2023-43000](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43000.md) | Nov 5, 2025 | | Linux | webkit2gtk Debian 14 | 2.42.0-1 | [DEBIAN-CVE-2023-43000](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43000.md) | Nov 5, 2025 | | Linux | webkit2gtk-driver Ubuntu 22.04.1 LTS (jammy) | 2.42.1-0ubuntu0.22.04.1 | [webkit2gtk-driver 2.42.1-0ubuntu0.22.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-webkit2gtk-driver-2.42.1-0ubuntu0.22.04.1.md) | Nov 5, 2025 | | Linux | webkit2gtk3 RHEL 8 | 0:2.42.5-1.el8 | [RHSA-2024:2982](https://patchblox.com/security/data/fix/linux/rhsa-2024-2982.md) | May 22, 2024 | | Linux | webkit2gtk3 RHEL 9 | 0:2.42.5-1.el9 | [RHSA-2024:2126](https://patchblox.com/security/data/fix/linux/rhsa-2024-2126.md) | Apr 30, 2024 | | Linux | webkit2gtk3 almalinux 8 | 2.50.3-1.el8_10 | [ALSA-2025:22789](https://patchblox.com/security/data/fix/linux/alsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3 almalinux 9 | 2.50.3-1.el9_7 | [ALSA-2025:22790](https://patchblox.com/security/data/fix/linux/alsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3 ol 8 | 0:2.50.3-1.el8_10 | [ELSA-2025-22789](https://patchblox.com/security/data/fix/linux/elsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3 ol 9 | 0:2.50.3-1.el9_7 | [ELSA-2025-22790](https://patchblox.com/security/data/fix/linux/elsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3 opensuse-leap 15.6 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk3 opensuse-leap 16.0 | 2.50.4-160000.1.1 | [OPENSUSE-SU-2026:20065-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20065-1.md) | Jan 20, 2026 | | Linux | webkit2gtk3 rocky 8 | 0:2.50.3-1.el8_10 | [RLSA-2025:22789](https://patchblox.com/security/data/fix/linux/rlsa-2025-22789.md) | Dec 9, 2025 | | Linux | webkit2gtk3 rocky 9 | 0:2.50.3-1.el9_7 | [RLSA-2025:22790](https://patchblox.com/security/data/fix/linux/rlsa-2025-22790.md) | Dec 9, 2025 | | Linux | webkit2gtk3 sles 15.6 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk3 sles 15.7 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk3 sles 16.0 | 2.50.4-160000.1.1 | [SUSE-SU-2026:20102-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20102-1.md) | Jan 20, 2026 | | Linux | webkit2gtk3-devel RHEL 8 | 0:2.42.5-1.el8 | [RHSA-2024:2982](https://patchblox.com/security/data/fix/linux/rhsa-2024-2982.md) | May 22, 2024 | | Linux | webkit2gtk3-devel RHEL 9 | 0:2.42.5-1.el9 | [RHSA-2024:2126](https://patchblox.com/security/data/fix/linux/rhsa-2024-2126.md) | Apr 30, 2024 | | Linux | webkit2gtk3-devel almalinux 8 | 2.50.3-1.el8_10 | [ALSA-2025:22789](https://patchblox.com/security/data/fix/linux/alsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3-devel almalinux 9 | 2.50.3-1.el9_7 | [ALSA-2025:22790](https://patchblox.com/security/data/fix/linux/alsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3-devel ol 8 | 0:2.50.3-1.el8_10 | [ELSA-2025-22789](https://patchblox.com/security/data/fix/linux/elsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3-devel ol 9 | 0:2.50.3-1.el9_7 | [ELSA-2025-22790](https://patchblox.com/security/data/fix/linux/elsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc RHEL 8 | 0:2.42.5-1.el8 | [RHSA-2024:2982](https://patchblox.com/security/data/fix/linux/rhsa-2024-2982.md) | May 22, 2024 | | Linux | webkit2gtk3-jsc RHEL 9 | 0:2.42.5-1.el9 | [RHSA-2024:2126](https://patchblox.com/security/data/fix/linux/rhsa-2024-2126.md) | Apr 30, 2024 | | Linux | webkit2gtk3-jsc almalinux 8 | 2.50.3-1.el8_10 | [ALSA-2025:22789](https://patchblox.com/security/data/fix/linux/alsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc almalinux 9 | 2.50.3-1.el9_7 | [ALSA-2025:22790](https://patchblox.com/security/data/fix/linux/alsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc ol 8 | 0:2.50.3-1.el8_10 | [ELSA-2025-22789](https://patchblox.com/security/data/fix/linux/elsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc ol 9 | 0:2.50.3-1.el9_7 | [ELSA-2025-22790](https://patchblox.com/security/data/fix/linux/elsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc-devel RHEL 8 | 0:2.42.5-1.el8 | [RHSA-2024:2982](https://patchblox.com/security/data/fix/linux/rhsa-2024-2982.md) | May 22, 2024 | | Linux | webkit2gtk3-jsc-devel RHEL 9 | 0:2.42.5-1.el9 | [RHSA-2024:2126](https://patchblox.com/security/data/fix/linux/rhsa-2024-2126.md) | Apr 30, 2024 | | Linux | webkit2gtk3-jsc-devel almalinux 8 | 2.50.3-1.el8_10 | [ALSA-2025:22789](https://patchblox.com/security/data/fix/linux/alsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc-devel almalinux 9 | 2.50.3-1.el9_7 | [ALSA-2025:22790](https://patchblox.com/security/data/fix/linux/alsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc-devel ol 8 | 0:2.50.3-1.el8_10 | [ELSA-2025-22789](https://patchblox.com/security/data/fix/linux/elsa-2025-22789.md) | Dec 8, 2025 | | Linux | webkit2gtk3-jsc-devel ol 9 | 0:2.50.3-1.el9_7 | [ELSA-2025-22790](https://patchblox.com/security/data/fix/linux/elsa-2025-22790.md) | Dec 8, 2025 | | Linux | webkit2gtk3-soup2 opensuse-leap 15.6 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk3-soup2 opensuse-leap 16.0 | 2.50.4-160000.1.1 | [OPENSUSE-SU-2026:20065-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20065-1.md) | Jan 20, 2026 | | Linux | webkit2gtk3-soup2 sles 15.6 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk3-soup2 sles 15.7 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk4 opensuse-leap 15.6 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk4 opensuse-leap 16.0 | 2.50.4-160000.1.1 | [OPENSUSE-SU-2026:20065-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20065-1.md) | Jan 20, 2026 | | Linux | webkit2gtk4 sles 15.6 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk4 sles 15.7 | 2.50.4-150600.12.54.1 | [SUSE-SU-2026:0021-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0021-1.md) | Jan 5, 2026 | | Linux | webkit2gtk4 sles 16.0 | 2.50.4-160000.1.1 | [SUSE-SU-2026:20102-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20102-1.md) | Jan 20, 2026 | | Linux | wpewebkit Debian 13.5 (trixie) | 2.42.0-1 | [DEBIAN-CVE-2023-43000](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43000.md) | Nov 5, 2025 | | Linux | wpewebkit Debian 14 | 2.42.0-1 | [DEBIAN-CVE-2023-43000](https://patchblox.com/security/data/fix/linux/debian-cve-2023-43000.md) | Nov 5, 2025 | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.