{
  "cveId": "CVE-2026-65331",
  "url": "https://patchblox.com/security/cve/CVE-2026-65331",
  "summary": "CVE-2026-65331 is fixed in 8 products on 1 platform, first by RHSA-2026:74084, released July 21, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform",
  "description": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.  \n\nSecurity Fix(es):  \n\n  * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)\n  * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)\n  * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)\n  * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)\n  * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)\n  * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)\n  * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)\n  * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)\n  * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)\n  * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)\n  * chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)\n  * webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)\n  * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)\n  * webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)\n  * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)\n  * webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "published": "2026-08-17T22:17:24Z",
  "severity": "important",
  "cvss": 9.6,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
  "epss": 0.00646,
  "epssPercentile": 0.51224,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "webkit2gtk",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.54.0-1~deb13u1",
      "fix": "DEBIAN-CVE-2026-65331",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-65331",
      "released": "2026-08-17T22:17:24Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "RHEL 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "RHSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-74084",
      "released": "2026-07-21T13:07:38Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "RHEL 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "RHSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69098",
      "released": "2026-08-22T23:50:18Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "almalinux 8",
      "fixedVersion": "2.54.0-1.el8_10",
      "fix": "ALSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-74084",
      "released": "2026-09-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "almalinux 9",
      "fixedVersion": "2.54.0-1.el9_8",
      "fix": "ALSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "ol 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "ELSA-2026-74084",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-74084",
      "released": "2026-10-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "ol 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "ELSA-2026-69098",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22076-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22076-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "rocky 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "RLSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-74084",
      "released": "2026-10-01T06:01:37Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "rocky 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "RLSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-69098",
      "released": "2026-09-22T18:04:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "sles 15.6",
      "fixedVersion": "2.54.1-150600.12.81.3",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "sles 15.7",
      "fixedVersion": "2.54.1-150600.12.81.3",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "sles 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "SUSE-SU-2026:24225-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24225-1",
      "released": "2026-11-07T00:44:01Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "RHSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-74084",
      "released": "2026-07-21T13:07:38Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "RHSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69098",
      "released": "2026-08-22T23:50:18Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-devel",
      "release": "almalinux 8",
      "fixedVersion": "2.54.0-1.el8_10",
      "fix": "ALSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-74084",
      "released": "2026-09-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-devel",
      "release": "almalinux 9",
      "fixedVersion": "2.54.0-1.el9_8",
      "fix": "ALSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-devel",
      "release": "ol 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "ELSA-2026-74084",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-74084",
      "released": "2026-10-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-devel",
      "release": "ol 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "ELSA-2026-69098",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc",
      "release": "RHEL 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "RHSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-74084",
      "released": "2026-07-21T13:07:38Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc",
      "release": "RHEL 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "RHSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69098",
      "released": "2026-08-22T23:50:18Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc",
      "release": "almalinux 8",
      "fixedVersion": "2.54.0-1.el8_10",
      "fix": "ALSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-74084",
      "released": "2026-09-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc",
      "release": "almalinux 9",
      "fixedVersion": "2.54.0-1.el9_8",
      "fix": "ALSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc",
      "release": "ol 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "ELSA-2026-74084",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-74084",
      "released": "2026-10-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc",
      "release": "ol 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "ELSA-2026-69098",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "RHSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-74084",
      "released": "2026-07-21T13:07:38Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "RHSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69098",
      "released": "2026-08-22T23:50:18Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc-devel",
      "release": "almalinux 8",
      "fixedVersion": "2.54.0-1.el8_10",
      "fix": "ALSA-2026:74084",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-74084",
      "released": "2026-09-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc-devel",
      "release": "almalinux 9",
      "fixedVersion": "2.54.0-1.el9_8",
      "fix": "ALSA-2026:69098",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc-devel",
      "release": "ol 8",
      "fixedVersion": "0:2.54.0-1.el8_10",
      "fix": "ELSA-2026-74084",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-74084",
      "released": "2026-10-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-jsc-devel",
      "release": "ol 9",
      "fixedVersion": "0:2.54.0-1.el9_8",
      "fix": "ELSA-2026-69098",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69098",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-soup2",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22076-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22076-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-soup2",
      "release": "sles 15.6",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-soup2",
      "release": "sles 15.7",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22076-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22076-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "sles 15.6",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "sles 15.7",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "sles 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "SUSE-SU-2026:24225-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24225-1",
      "released": "2026-11-07T00:44:01Z"
    },
    {
      "platform": "linux",
      "product": "wpewebkit",
      "release": "Debian 14",
      "fixedVersion": "2.54.0-1",
      "fix": "DEBIAN-CVE-2026-65331",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-65331",
      "released": "2026-08-17T22:17:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}