https://seclists.org/oss-sec/2026/q3/1031: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006

Q: Do installations need to upgrade to 2.54.0 to address CVE-2025-6558?

No. The advisory corrects an earlier mistake: CVE-2025-6558 was already fixed in WebKitGTK 2.48.5 and WPE WebKit 2.48.5.

Q: What is required for exploitation?

A remote attacker would need to cause the affected WebKitGTK or WPE WebKit instance to process a crafted HTML page. The reported impact is a potential sandbox escape caused by insufficient validation of untrusted input in ANGLE and GPU components.

Q: How can I determine whether an installation is affected?

Check the installed WebKitGTK or WPE WebKit version. Versions earlier than 2.48.5 have not received the fix identified by this advisory correction; version 2.48.5 and later include it.

Published Sep 30, 2026

Updated

Affected Software

2 affected components

WebKit WebKitGTK<2.54.0

WebKit WPE WebKit<2.54.0

Frequently Asked Questions

Do installations need to upgrade to 2.54.0 to address CVE-2025-6558?

No. The advisory corrects an earlier mistake: CVE-2025-6558 was already fixed in WebKitGTK 2.48.5 and WPE WebKit 2.48.5.

What is required for exploitation?

A remote attacker would need to cause the affected WebKitGTK or WPE WebKit instance to process a crafted HTML page. The reported impact is a potential sandbox escape caused by insufficient validation of untrusted input in ANGLE and GPU components.

How can I determine whether an installation is affected?

Check the installed WebKitGTK or WPE WebKit version. Versions earlier than 2.48.5 have not received the fix identified by this advisory correction; version 2.48.5 and later include it.