https://seclists.org/oss-sec/2026/q3/1031: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006
Published Sep 30, 2026
·Updated
Affected Software
2 affected components
WebKit WebKitGTK<2.54.0
WebKit WPE WebKit<2.54.0
No. The advisory corrects an earlier mistake: CVE-2025-6558 was already fixed in WebKitGTK 2.48.5 and WPE WebKit 2.48.5.
A remote attacker would need to cause the affected WebKitGTK or WPE WebKit instance to process a crafted HTML page. The reported impact is a potential sandbox escape caused by insufficient validation of untrusted input in ANGLE and GPU components.
Check the installed WebKitGTK or WPE WebKit version. Versions earlier than 2.48.5 have not received the fix identified by this advisory correction; version 2.48.5 and later include it.