CVE-2026-78376: Webkitgtk: use-after-free of jscvalue function parameters
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
Other sources
A use-after-free issue was addressed with improved memory handling. This issue does not affect Apple platforms. Processing maliciously crafted web content may lead to memory corruption.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using WebKitGTK to process web content are exposed. Apple platforms are explicitly not affected.
What does an attacker need to exploit it?
An attacker needs to get a user or affected application to process maliciously crafted web content. The published vector indicates network reachability, no required privileges, low attack complexity, and user interaction.
What is the potential impact?
Successful exploitation can cause memory corruption through a use-after-free condition. The severity vector indicates potential high impact to confidentiality, integrity, and availability.
What can be done if an update cannot be applied immediately?
The available information identifies malicious web content as the trigger, so limit processing of untrusted web content in WebKitGTK-based applications until the issue is remediated.