Zero Radar
← feed
HighVulnerabilityupdated 26 Oct 2026, 12:34 UTC

WebKitGTK browser engine: several high-severity flaws allow attacks

Attackers who can get you to load a malicious web page may be able to run their own code on your computer or crash the browser. Updating the software closes these holes.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerCrafts a malicious web page
  2. 2Web contentPage is loaded by the victim
  3. 3WebKitGTKMemory corruption in rendering engine
  4. 4Code runsAttacker code executes or app crashes
  5. ResultAttacker may run code on the device

What happened

Multiple vulnerabilities in WebKitGTK, the web rendering engine used by GTK-based applications, including memory corruption flaws that can lead to arbitrary code execution, security bypass, information disclosure, data manipulation, spoofing and denial of service.

Why it is dangerous: A remote, unauthenticated attacker can exploit these flaws without any login, potentially taking control of the affected application or crashing it. Anyone running applications that embed WebKitGTK to display web content is at risk.

Are you affected?

You are affected if you run applications built on WebKitGTK (for example GTK-based browsers or apps that embed web views) with an unpatched WebKitGTK version.

WebKitGTK (versions not specified in the provided material)

What to do

  1. Update WebKitGTK through your Linux distribution's package manager to the latest security release
  2. Restart any applications that use WebKitGTK after updating
  3. Check the CERT-Bund (BSI) advisory for the exact fixed versions

Timeline

  1. 23 Oct 2026, 10:22 UTC
    Publicly disclosed
  2. 23 Oct 2026, 10:22 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 23 Oct 2026, 10:22 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  4. 25 Oct 2026, 15:22 UTC
    Picked up by Zero Radar
  5. 26 Oct 2026, 11:44 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  6. 26 Oct 2026, 11:45 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-5a9e7cad · ZR-0166bf8d · ZR-1179e179
Disclosed
23 Oct 2026, 10:22 UTC
On Zero Radar
25 Oct 2026, 15:22 UTC (2 days after disclosure)
Last change
26 Oct 2026, 12:34 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WebKitGTK browser engine: several high-severity flaws allow attacks · Zero Radar