A use-after-free issue was addressed with improved memory management.

Impact: maliciously crafted web content may cause unexpected process crash

Advisory: https://webkitgtk.org/security/WSA-2026-0004.html WebKit Bug: https://bugs.webkit.org/showbug.cgi?id=313857

Versions affected: WebKitGTK and WPE WebKit before 2.40.1. Credit to Gertjan Franken of imec-DistriNet, KU Leuven. Impact: Content Security Policy to block domains with wildcards may fail. Description: A logic issue was addressed with improved validation.

Versions affected: WebKitGTK and WPE WebKit before 2.40.5. Credit to Johan Carlsson (joaxcar). Impact: A remote attacker may be able to cause arbitrary javascript code execution. Description: The issue was addressed with improved checks.

Versions affected: WebKitGTK and WPE WebKit before 2.40.1. Credit to hazbinhotel working with Trend Micro Zero Day Initiative. Impact: Processing web content may lead to arbitrary code execution. Description: A use-after-free issue was addressed with improved memory management.

Processing web content may lead to arbitrary code execution. A use-after-free issue was addressed with improved memory management.

Reference: https://webkitgtk.org/security/WSA-2023-0009.html#CVE-2023-39434