Home / mailings [SECURITY] [DSA 6463-1] webkit2gtk security update
Posted on 24 August 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6463-1 security@debian.org
https://www.debian.org/security/ Alberto Garcia
August 24, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : webkit2gtk
CVE ID : CVE-2026-43804 CVE-2026-64713 CVE-2026-64719 CVE-2026-64728
CVE-2026-64730 CVE-2026-64757 CVE-2026-64783
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
CVE-2026-43804
Heiko Kiesel discovered that visiting a website may lead to an app
denial-of-service.
CVE-2026-64713
Kwak Kiyong and Song Nuri discovered that websites may know if the
user has visited a given link.
CVE-2026-64719
Shaheen Fazim discovered that processing maliciously crafted web
content may lead to an unexpected process crash.
CVE-2026-64728
An anonymous researcher discovered that maliciously crafted web
content may violate iframe sandboxing policy.
CVE-2026-64730
Kagami Rosylight discovered that visiting a website that frames
malicious content may lead to UI spoofing.
CVE-2026-64757
Milad Nasr and Nicholas Carlini discovered that processing
maliciously crafted web content may lead to an unexpected process
crash.
CVE-2026-64783
lattice, Behzad Najjarpour Jabbari, Junyeong Lee, OGINOME
Tomohito, Gia Bui and others discovered that processing
maliciously crafted web content may lead to an unexpected process
crash.
For the stable distribution (trixie), these problems have been fixed in
version 2.52.6-1~deb13u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
