VIR Vulnerability Intelligence Relay

CVE-2026-28871

high
Published 2026-05-19 · Modified 2026-04-27
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
8.0

Description

A logic issue was addressed with improved checks. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4. Visiting a maliciously crafted website may lead to a cross-site scripting attack.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack Red Hat statement To exploit this flaw, an attacker needs to trick a user into visiting a maliciously crafted web page. Due to this reason, this flaw has been rated with a moderate severity. CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Errata / fixed releases…

Description

webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack

Red Hat statement

To exploit this flaw, an attacker needs to trick a user into visiting a maliciously crafted web page. Due to this reason, this flaw has been rated with a moderate severity.

CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Errata / fixed releases

ProductPackageAdvisoryReleased
Red Hat Enterprise Linux 8webkit2gtk3-0:2.52.3-1.el8_10RHSA-2026:107022026-04-27T00:00:00Z
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportwebkit2gtk3-0:2.52.3-1.el8_4RHSA-2026:160562026-05-11T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onwebkit2gtk3-0:2.52.3-1.el8_4RHSA-2026:160562026-05-11T00:00:00Z
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportwebkit2gtk3-0:2.52.3-1.el8_6RHSA-2026:138452026-05-05T00:00:00Z
Red Hat Enterprise Linux 8.6 Telecommunications Update Servicewebkit2gtk3-0:2.52.3-1.el8_6RHSA-2026:138452026-05-05T00:00:00Z
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionswebkit2gtk3-0:2.52.3-1.el8_6RHSA-2026:138452026-05-05T00:00:00Z
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicewebkit2gtk3-0:2.52.3-1.el8_8RHSA-2026:118142026-04-29T00:00:00Z
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionswebkit2gtk3-0:2.52.3-1.el8_8RHSA-2026:118142026-04-29T00:00:00Z
Red Hat Enterprise Linux 9webkit2gtk3-0:2.52.3-1.el9_8RHSA-2026:192062026-05-19T00:00:00Z
Red Hat Enterprise Linux 9webkit2gtk3-0:2.52.3-0.el9_7.1RHSA-2026:96922026-04-22T00:00:00Z
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionswebkit2gtk3-0:2.52.3-1.el9_0RHSA-2026:195352026-05-20T00:00:00Z
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionswebkit2gtk3-0:2.52.3-1.el9_2RHSA-2026:166952026-05-13T00:00:00Z
Red Hat Enterprise Linux 9.4 Extended Update Supportwebkit2gtk3-0:2.52.3-1.el9_4RHSA-2026:146592026-05-07T00:00:00Z
Red Hat Enterprise Linux 9.6 Extended Update Supportwebkit2gtk3-0:2.52.3-1.el9_6RHSA-2026:113292026-04-28T00:00:00Z

Package state

ProductPackageState
Red Hat Enterprise Linux 6webkitgtkOut of support scope
Red Hat Enterprise Linux 7webkitgtk3Not affected
Red Hat Enterprise Linux 7webkitgtk4Affected

Apply commands

bash fix
Apply RHSA-2026:10702 for Red Hat Enterprise Linux 8
yum update -y webkit2gtk3
# or:
dnf upgrade -y webkit2gtk3

Affected

VendorProductVersion
redhatRed Hat Enterprise Linux 7Not affected
redhatRed Hat Enterprise Linux 7Affected

OS impact
suse SUSE Affected 1 release
VersionStatusFixed in
— Affected —
debian Debian Mixed 5 releases
VersionStatusFixed in
trixie Fixed 2.52.3-2~deb13u1
sid Fixed 2.52.1-1
forky Fixed 2.52.1-1
bullseye Affected —
bookworm Affected —
ios Fixed 2 releases
VersionStatusFixed in
26.4 Fixed —
18.7.7 Fixed —
macos macOS Fixed 1 release
VersionStatusFixed in
26.4 Fixed —
redhat Red Hat Fixed 2 releases
VersionStatusFixed in
9 Fixed —
8 Fixed —
rockylinux Rocky Linux Fixed 1 release
VersionStatusFixed in
9 Fixed —
safari Fixed 1 release
VersionStatusFixed in
26.4 Fixed —

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.