Debian webkit2gtk Critical JavaScript Exec Risk DSA-6398-1

debian

July 23, 2026

Multiple vulnerabilities in WebKitGTK have been identified, leading to process crashes, memory corruption, and potential data leaks; users are urged to upgrade to the latest versio...

Topics Covered

security advisory debian malicious content web engine process crash JavaScript execution

Summary

CVE-2024-4367

Thomas Rinsma discovered that a type check was missing when
handling fonts in PDF.js, which would allow arbitrary JavaScript
execution in the PDF.js context.

CVE-2026-28847

DARKNAVY, an anonymous researcher and Daniel Rhea discovered that
processing maliciously crafted web content may lead to an
unexpected process crash.

CVE-2026-28883

Kwak Kiyong discovered that processing maliciously crafted web
content may lead to an unexpected process crash.

CVE-2026-28901

Joshua Rogers, Luigino Camastra, Igor Morgenstern, Guido Vranken,
Maher Azzouzi and Ngan Nguyen discovered that processing
maliciously crafted web content may lead to an unexpected process
crash.

CVE-2026-28902

Tristan Madani and Nathaniel Oh discovered that processing
maliciously crafted web content may lead to an unexpected process
crash.

CVE-2026-28903

Mateusz Krzywicki discovered that processing maliciously crafted
web content may lead to an unexpected process crash.

...