2026-05-06T11:55:02+00:00 https://webkitgtk.org 2026-05-06T00:00:00+00:00 http://tom.preston-werner.com/2026/05/06/webkitgtk2.53.2-released <p>This is a development release leading toward 2.54 series.</p> <h3 id="whats-new-in-the-webkitgtk-2532-release">What’s new in the WebKitGTK 2.53.2 release?</h3> <ul> <li>Only use DMA-BUF mapping for writing to the GPU atlas when possible.</li> <li>Do not resolve ‘-apple-system’ font to default system font.</li> <li>Set real time limits when not using the portal.</li> <li>Report support for supported non-AAC mp4a codecs.</li> <li>Fix several crashes and rendering issues.</li> </ul> <p>Thanks to all the contributors who made possible this release.</p> 2026-04-17T00:00:00+00:00 http://tom.preston-werner.com/2026/04/17/webkitgtk2.53.1-released <p>This is the first development release leading toward 2.54 series.</p> <h3 id="whats-new-in-the-webkitgtk-2531-release">What’s new in the WebKitGTK 2.53.1 release?</h3> <ul> <li>Remove the option to use cairo for 2D rendering.</li> <li>Implement GPU atlas creation and replay substitution for batched raster image uploads.</li> <li>Improved non accelerated composited mode by using the same buffer sharing implementation as accelerated mode.</li> <li>The on-demand hardware acceleration policy is now deprecated in GTK3 API.</li> <li>Add new improved API for page favicons.</li> <li>Add webkit_feature_list_find() to public API.</li> <li>Support PGO features in regular CMake builds.</li> <li>Fix several crashes and rendering issues.</li> </ul> <p>Thanks to all the contributors who made possible this release.</p> 2026-04-16T00:00:00+00:00 http://tom.preston-werner.com/2026/04/16/webkitgtk2.52.3-released <p>This is a bug fix release in the stable 2.52 series.</p> <h3 id="whats-new-in-the-webkitgtk-2523-release">What’s new in the WebKitGTK 2.52.3 release?</h3> <ul> <li>Add support for the “scrollbar-color” CSS property.</li> <li>Fix some emoji glyphs being rendered as missing glyph boxes.</li> <li>Fix JavaScriptCore crashes on architectures other than x86_64.</li> <li>Fix the build on s390x.</li> <li>Fix several crashes and rendering issues.</li> <li>Translation updates: Serbian.</li> </ul> <p>Thanks to all the contributors who made possible this release.</p> 2026-04-13T00:00:00+00:00 http://tom.preston-werner.com/2026/04/13/webkitgtk2.52.2-released <p>This is a bug fix release in the stable 2.52 series.</p> <h3 id="whats-new-in-the-webkitgtk-2522-release">What’s new in the WebKitGTK 2.52.2 release?</h3> <ul> <li>Improve handling of real-time threads.</li> <li>Fix scrollbar rendering glitches visible in some GPU configurations.</li> <li>Fix V4L2 hardware accelerated media codecs now working due to overly restrictive sandbox device access rules.</li> <li>Fix leak of bitmap images in <code class="language-plaintext highlighter-rouge">webkit_favicon_database_get_favicon_finish()</code>.</li> <li>Fix the build with <code class="language-plaintext highlighter-rouge">USE_GTK4=OFF</code>.</li> <li>Partially fix the build in BSD and other non-Linux Unix systems.</li> <li>Fix several crashes and rendering issues.</li> </ul> <p>Thanks to all the contributors who made possible this release.</p> 2026-03-28T00:00:00+00:00 http://tom.preston-werner.com/security/security-advisory-2026-0002 <ul> <li> <p>Date Reported: <strong>March 28, 2026</strong></p> </li> <li> <p>Advisory ID: <strong>WSA-2026-0002</strong></p> </li> <li> <p>CVE identifiers: <a href="#CVE-2026-20643">CVE-2026-20643</a>, <a href="#CVE-2026-20664">CVE-2026-20664</a>, <a href="#CVE-2026-20665">CVE-2026-20665</a>, <a href="#CVE-2026-20691">CVE-2026-20691</a>, <a href="#CVE-2026-28857">CVE-2026-28857</a>, <a href="#CVE-2026-28859">CVE-2026-28859</a>, <a href="#CVE-2026-28861">CVE-2026-28861</a>, <a href="#CVE-2026-28871">CVE-2026-28871</a></p> </li> </ul> <p>Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.</p> <ul> <li><a name="CVE-2026-20643" href="https://www.cve.org/CVERecord?id=CVE-2026-20643">CVE-2026-20643</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to Thomas Espach.</li> <li>Impact: Processing maliciously crafted web content may bypass Same Origin Policy. Description: A cross-origin issue in the Navigation API was addressed with improved input validation.</li> <li>WebKit Bugzilla: 306050</li> </ul> </li> <li><a name="CVE-2026-20664" href="https://www.cve.org/CVERecord?id=CVE-2026-20664">CVE-2026-20664</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to Daniel Rhea, Söhnke Benedikt Fischedick (Tripton), Emrovsky &amp; Switch, Yevhen Pervushyn.</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 306136</li> </ul> </li> <li><a name="CVE-2026-20665" href="https://www.cve.org/CVERecord?id=CVE-2026-20665">CVE-2026-20665</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to webb.</li> <li>Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: This issue was addressed through improved state management.</li> <li>WebKit Bugzilla: 304951</li> </ul> </li> <li><a name="CVE-2026-20691" href="https://www.cve.org/CVERecord?id=CVE-2026-20691">CVE-2026-20691</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to Gongyu Ma (@Mezone0).</li> <li>Impact: A maliciously crafted webpage may be able to fingerprint the user. Description: An authorization issue was addressed with improved state management.</li> <li>WebKit Bugzilla: 306827</li> </ul> </li> <li><a name="CVE-2026-28857" href="https://www.cve.org/CVERecord?id=CVE-2026-28857">CVE-2026-28857</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to Narcis Oliveras Fontàs, Söhnke Benedikt Fischedick (Tripton), Daniel Rhea, Nathaniel Oh (@calysteon).</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 307723</li> </ul> </li> <li><a name="CVE-2026-28859" href="https://www.cve.org/CVERecord?id=CVE-2026-28859">CVE-2026-28859</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to greenbynox, Arni Hardarson.</li> <li>Impact: A malicious website may be able to process restricted web content outside the sandbox. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 308248</li> </ul> </li> <li><a name="CVE-2026-28861" href="https://www.cve.org/CVERecord?id=CVE-2026-28861">CVE-2026-28861</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to Hongze Wu and Shuaike Dong from Ant Group Infrastructure Security Team.</li> <li>Impact: A malicious website may be able to access script message handlers intended for other origins. Description: A logic issue was addressed with improved state management.</li> <li>WebKit Bugzilla: 307014</li> </ul> </li> <li><a name="CVE-2026-28871" href="https://www.cve.org/CVERecord?id=CVE-2026-28871">CVE-2026-28871</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.1.</li> <li>Credit to @hamayanhamayan.</li> <li>Impact: Visiting a maliciously crafted website may lead to a cross-site scripting attack. Description: A logic issue was addressed with improved checks.</li> <li>WebKit Bugzilla: 305859</li> </ul> </li> </ul> <p>We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.</p> <p>Further information about WebKitGTK and WPE WebKit security advisories can be found at: <a href="https://webkitgtk.org/security.html">webkitgtk.org/security.html</a> or <a href="https://wpewebkit.org/security">wpewebkit.org/security</a>.</p> 2026-03-27T00:00:00+00:00 http://tom.preston-werner.com/2026/03/27/webkitgtk2.52.1-released <p>This is the first bug fix release in the stable 2.52 series.</p> <h3 id="whats-new-in-the-webkitgtk-2521-release">What’s new in the WebKitGTK 2.52.1 release?</h3> <ul> <li>Reduce the amount of useless MPRIS notifications produced by <code class="language-plaintext highlighter-rouge">MediaSesion</code> when the information about media being played is incomplete.</li> <li>Support turning off <code class="language-plaintext highlighter-rouge">USE_GSTREAMER</code> to configure the build with all multimedia features disabled.</li> <li>Add Sysprof marks for mouse events.</li> <li>Fix MediaSession icon for iheart.com not being displayed.</li> <li>Fix the build with <code class="language-plaintext highlighter-rouge">USE_GSTREAMER_GL</code> disabled.</li> <li>Fix the build with librice version 0.3.0 or newer.</li> <li>Fix several crashes and rendering issues.</li> <li>Translation updates: Georgian.</li> </ul> <p>Thanks to all the contributors who made possible this release.</p> 2026-03-18T00:00:00+00:00 http://tom.preston-werner.com/2026/03/18/webkitgtk2.52.0-released <p>This is the first stable release in the 2.52 series.</p> <h3 id="highlights-of-the-webkitgtk-2520-release">Highlights of the WebKitGTK 2.52.0 release</h3> <ul> <li>Make text look like in other browsers by blending in linear color space.</li> <li>Improved rendering performance by using a different tile size depending on whether GPU rendering is enabled or not.</li> <li>Improved composition scheduling to avoid blocking waiting for tile painting.</li> <li>Improved performance of accelerated 2D canvas by recording operations for batched replay.</li> <li>Improved async scrolling when main thread is busy by avoiding locks and rendering the scrollbars from the scrolling thread.</li> <li>Enabled dynamic MSAA for accelerated 2D canvas rendering.</li> <li>Improved text rendering performance</li> <li>Videos with BT2100-PQ colorspace are now tone-mapped to SDR, ensuring colours do not appear washed out.</li> <li>Added support for the Audio Output Devices API.</li> <li>Added API to handle WebXR permission requests.</li> <li>Added API to query the immersive session status.</li> <li>Added initial API for web extensions.</li> </ul> <p>For more details about all the changes included in WebKitGTK 2.52 see the NEWS file that is included in the tarball.</p> <p>Thanks to all the contributors who made possible this release.</p> 2026-03-18T00:00:00+00:00 http://tom.preston-werner.com/2026/03/18/webkitgtk-2.52-highlights <p>The WebKit team at Igalia is happy to announce a new release series of WebKitGTK. This is a summary of the most noteworthy changes from the latest release cycle.</p> <h2 id="libsoup-2-support-has-been-removed">libsoup 2 support has been removed</h2> <p>As it was announced in October last year, this is the first release series that only supports libsoup 3. Please take a look at the <a href="https://webkitgtk.org/2025/10/07/webkitgtk-soup2-deprecation.html">official annoucement</a> for the details.</p> <h2 id="graphics-improvements">Graphics improvements</h2> <p>WebKitGTK graphics support has seen numerous improvements with a positive impact in rendering performance, resource usage, and better rendering. Let’s have a look at some of the most significant changes:</p> <ul> <li>Compute the layers tile size, using a different strategy depending on whether GPU rendering is enabled. This optimizes resource usage depending on both hardware and software rendering mode.</li> <li>WebKitGTK now uses run-loop observers to properly schedule layer flushing and composition, which results in snappier and better performing rendering and animation.</li> <li>2D-canvas acceleration has now improved performance, as operations are recorded for batched replay.</li> <li>Text rendering has better performance too.</li> <li>In non-composite mode, it’s now also possible to use damage propagation.</li> <li>Asynchronous scrolling has also seen performance improvements.</li> </ul> <p>Additionally, many rendering issues have been fixed.</p> <h2 id="multimedia-improvements">Multimedia improvements</h2> <h3 id="webrtc">WebRTC</h3> <p>When using <code class="language-plaintext highlighter-rouge">GstWebRTC</code>, WebRTC network access has been moved to the network process. This also requires librice, and building with the CMake <code class="language-plaintext highlighter-rouge">USE_LIBRICE</code> option. When this is enabled, it is still possible to choose the older libnice-based implementation at runtime by setting <code class="language-plaintext highlighter-rouge">WEBKIT_GST_DISABLE_WEBRTC_NETWORK_SANDBOX=1</code> in the environment.</p> <p>Having WebRTC network access in the network process is a security improvement, as it reduces the surface of attack in other more sensitive processes.</p> <h3 id="other-multimedia-improvements">Other multimedia improvements</h3> <ul> <li>Videos with BT2100-PQ colorspace are now tone-mapped to SDR, ensuring colours do not appear washed out.</li> <li>Support for the <a href="https://w3c.github.io/mediacapture-output/">Audio Output Devices API</a>, which allows Web content to enumerate audio devices and decide which one to use for output. This feature is disabled by default, and may be previewed using the <code class="language-plaintext highlighter-rouge">ExposeSpeakers</code>, <code class="language-plaintext highlighter-rouge">ExposeSpeakersWithoutMicrophone</code>, and <code class="language-plaintext highlighter-rouge">PerElementSpeakerSelection</code> <a href="https://wpewebkit.org/reference/stable/wpe-webkit-2.0/struct.Feature.html">feature flags</a>.</li> <li>Many code improvements to the GStreamer backend that will result in a more stable multimedia experience.</li> </ul> <h2 id="webxr">WebXR</h2> <p>WebXR support through OpenXR has seen substantial development this cycle:</p> <ul> <li>New API has been added in order to support <a href="https://webkitgtk.org/reference/webkitgtk/2.52.0/class.XRPermissionRequest.html">WebXR session permissions</a>, <a href="https://webkitgtk.org/reference/webkitgtk/2.52.0/method.WebView.is_immersive_mode_enabled.html">querying whether a session is active</a> and <a href="https://webkitgtk.org/reference/webkitgtk/2.52.0/method.WebView.leave_immersive_mode.html">requesting to leave a session</a>.</li> <li>Support for <a href="https://www.w3.org/TR/webxr-hand-input-1/">WebXR Hand Input module</a> has been added for ports using OpenXR.</li> <li>Support for <a href="https://www.w3.org/TR/webxr-hit-test-1/">WebXR Hit Test Module</a> is added with <em>testable</em> status, so it can be enabled at runtime (<code class="language-plaintext highlighter-rouge">--features=+WebXRHitTestModule</code>) or at build time passing <code class="language-plaintext highlighter-rouge">-DENABLE_WEBXR_HIT_TEST=ON</code>.</li> </ul> <h2 id="api-changes">API Changes</h2> <ul> <li>An <a href="https://webkitgtk.org/reference/webkitgtk/2.52.0/class.WebExtension.html">initial API to support Web Extensions</a> has been added in this release cycle.</li> </ul> <h2 id="web-standards-support">Web Standards support</h2> <p>As usual, this list is not exhaustive as WebKit continuously progresses in its support for new standards. Some of the highlights for this release are:</p> <ul> <li><a href="https://www.w3.org/TR/largest-contentful-paint/">Largest Contentful Paint</a> is now enabled.</li> <li>Pointer and Touch Events now use more precise fractional coordinates.</li> <li>The <a href="https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API">Fetch API</a> now accepts local connections.</li> <li>The <a href="https://developer.mozilla.org/en-US/docs/Web/API/Navigation_API">Navigation API</a> is now enabled.</li> <li>The <a href="https://developer.mozilla.org/en-US/docs/Web/API/PerformanceEventTiming">Event Timing API</a> is now enabled.</li> <li>The <a href="https://drafts.csswg.org/css-values-5/#random">CSS random() function</a> (in draft status) is now available.</li> <li><a href="https://developer.mozilla.org/en-US/docs/Web/CSS/field-sizing">CSS field-sizing</a> is now available.</li> <li>The <a href="https://developer.mozilla.org/en-US/docs/Web/API/Keyboard/lock">Keyboard lock API</a> is now available.</li> <li>The <a href="https://html.spec.whatwg.org/multipage/browsers.html#the-origin-interface">Origin API</a> is now available.</li> <li>The <a href="https://developer.mozilla.org/en-US/docs/Web/API/Streams_API">Readable Byte Streams API</a> is now available.</li> <li>Enabled CSS grid-lanes (a.k.a. Masonry layout), part of <a href="https://www.w3.org/TR/css-grid-3/">CSS Grid Layout Module Level 3</a>.</li> </ul> <h2 id="other-notes">Other notes</h2> <p>The Flatpak-based development SDK <a href="https://commits.webkit.org/303246@main">has been removed</a>. Developers are encouraged to use the <a href="https://github.com/Igalia/webkit-container-sdk"><strong>WebKit Container SDK</strong></a> instead.</p> <p>Building with Enchant 1.x is no longer supported, Enchant 2.x is now always used for spell-checking.</p> 2026-03-18T00:00:00+00:00 http://tom.preston-werner.com/security/security-advisory-2026-0001 <ul> <li> <p>Date Reported: <strong>March 18, 2026</strong></p> </li> <li> <p>Advisory ID: <strong>WSA-2026-0001</strong></p> </li> <li> <p>CVE identifiers: <a href="#CVE-2023-43010">CVE-2023-43010</a>, <a href="#CVE-2025-31223">CVE-2025-31223</a>, <a href="#CVE-2025-31277">CVE-2025-31277</a>, <a href="#CVE-2025-43213">CVE-2025-43213</a>, <a href="#CVE-2025-43214">CVE-2025-43214</a>, <a href="#CVE-2025-43433">CVE-2025-43433</a>, <a href="#CVE-2025-43438">CVE-2025-43438</a>, <a href="#CVE-2025-43441">CVE-2025-43441</a>, <a href="#CVE-2025-43457">CVE-2025-43457</a>, <a href="#CVE-2025-43511">CVE-2025-43511</a>, <a href="#CVE-2025-46299">CVE-2025-46299</a>, <a href="#CVE-2026-20608">CVE-2026-20608</a>, <a href="#CVE-2026-20635">CVE-2026-20635</a>, <a href="#CVE-2026-20636">CVE-2026-20636</a>, <a href="#CVE-2026-20644">CVE-2026-20644</a>, <a href="#CVE-2026-20652">CVE-2026-20652</a>, <a href="#CVE-2026-20676">CVE-2026-20676</a></p> </li> </ul> <p>Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.</p> <ul> <li><a name="CVE-2023-43010" href="https://www.cve.org/CVERecord?id=CVE-2023-43010">CVE-2023-43010</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.44.0.</li> <li>Credit to Apple.</li> <li>Impact: Processing maliciously crafted web content may lead to memory corruption. This fix associated with the Coruna exploit was shipped in iOS 17.2 on December 11th, 2023. This update brings that fix to devices that cannot update to the latest iOS version. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 260913</li> </ul> </li> <li><a name="CVE-2025-31223" href="https://www.cve.org/CVERecord?id=CVE-2025-31223">CVE-2025-31223</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.0.</li> <li>Credit to Andreas Jaegersberger &amp; Ro Achterberg of Nosebeard Labs.</li> <li>Impact: Processing maliciously crafted web content may lead to memory corruption. Description: The issue was addressed with improved checks.</li> <li>WebKit Bugzilla: 289387</li> </ul> </li> <li><a name="CVE-2025-31277" href="https://www.cve.org/CVERecord?id=CVE-2025-31277">CVE-2025-31277</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.0.</li> <li>Credit to Yuhao Hu, Yan Kang, Chenggang Wu, and Xiaojie Wei.</li> <li>Impact: Processing maliciously crafted web content may lead to memory corruption. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 291745</li> </ul> </li> <li><a name="CVE-2025-43213" href="https://www.cve.org/CVERecord?id=CVE-2025-43213">CVE-2025-43213</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.5.</li> <li>Credit to Google V8 Security Team.</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 292621</li> </ul> </li> <li><a name="CVE-2025-43214" href="https://www.cve.org/CVERecord?id=CVE-2025-43214">CVE-2025-43214</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.5.</li> <li>Credit to shandikri working with Trend Micro Zero Day Initiative, Google V8 Security Team.</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 292599</li> </ul> </li> <li><a name="CVE-2025-43433" href="https://www.cve.org/CVERecord?id=CVE-2025-43433">CVE-2025-43433</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.2.</li> <li>Credit to Google Big Sleep.</li> <li>Impact: Processing maliciously crafted web content may lead to memory corruption. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 298093</li> </ul> </li> <li><a name="CVE-2025-43438" href="https://www.cve.org/CVERecord?id=CVE-2025-43438">CVE-2025-43438</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.2.</li> <li>Credit to rheza (@ginggilBesel), shandikri working with Trend Micro Zero Day Initiative.</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.</li> <li>WebKit Bugzilla: 297662</li> </ul> </li> <li><a name="CVE-2025-43441" href="https://www.cve.org/CVERecord?id=CVE-2025-43441">CVE-2025-43441</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.2.</li> <li>Credit to rheza (@ginggilBesel).</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 298496</li> </ul> </li> <li><a name="CVE-2025-43457" href="https://www.cve.org/CVERecord?id=CVE-2025-43457">CVE-2025-43457</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.6.</li> <li>Credit to Gary Kwong, Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative.</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.</li> <li>WebKit Bugzilla: 298606</li> </ul> </li> <li><a name="CVE-2025-43511" href="https://www.cve.org/CVERecord?id=CVE-2025-43511">CVE-2025-43511</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.5.</li> <li>Credit to 이동하 (Lee Dong Ha of BoB 14th).</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.</li> <li>WebKit Bugzilla: 300926</li> </ul> </li> <li><a name="CVE-2025-46299" href="https://www.cve.org/CVERecord?id=CVE-2025-46299">CVE-2025-46299</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.52.0.</li> <li>Credit to Google Big Sleep.</li> <li>Impact: Processing maliciously crafted web content may disclose internal states of the app. Description: A memory initialization issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 299518</li> </ul> </li> <li><a name="CVE-2026-20608" href="https://www.cve.org/CVERecord?id=CVE-2026-20608">CVE-2026-20608</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.6.</li> <li>Credit to HanQing from TSDubhe and Nan Wang (@eternalsakura13).</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: This issue was addressed through improved state management.</li> <li>WebKit Bugzilla: 303357</li> </ul> </li> <li><a name="CVE-2026-20635" href="https://www.cve.org/CVERecord?id=CVE-2026-20635">CVE-2026-20635</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.6.</li> <li>Credit to EntryHi.</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 304661</li> </ul> </li> <li><a name="CVE-2026-20636" href="https://www.cve.org/CVERecord?id=CVE-2026-20636">CVE-2026-20636</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.6.</li> <li>Credit to EntryHi.</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 304657</li> </ul> </li> <li><a name="CVE-2026-20644" href="https://www.cve.org/CVERecord?id=CVE-2026-20644">CVE-2026-20644</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.6.</li> <li>Credit to HanQing from TSDubhe and Nan Wang (@eternalsakura13).</li> <li>Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 303444</li> </ul> </li> <li><a name="CVE-2026-20652" href="https://www.cve.org/CVERecord?id=CVE-2026-20652">CVE-2026-20652</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.6.</li> <li>Credit to Nathaniel Oh (@calysteon).</li> <li>Impact: A remote attacker may be able to cause a denial-of-service. Description: The issue was addressed with improved memory handling.</li> <li>WebKit Bugzilla: 303959</li> </ul> </li> <li><a name="CVE-2026-20676" href="https://www.cve.org/CVERecord?id=CVE-2026-20676">CVE-2026-20676</a> <ul> <li>Versions affected: WebKitGTK and WPE WebKit before 2.50.6.</li> <li>Credit to Tom Van Goethem.</li> <li>Impact: A website may be able to track users through Safari web extensions. Description: This issue was addressed through improved state management.</li> <li>WebKit Bugzilla: 305020</li> </ul> </li> </ul> <p>We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.</p> <p>Further information about WebKitGTK and WPE WebKit security advisories can be found at: <a href="https://webkitgtk.org/security.html">webkitgtk.org/security.html</a> or <a href="https://wpewebkit.org/security">wpewebkit.org/security</a>.</p> 2026-03-12T00:00:00+00:00 http://tom.preston-werner.com/2026/03/12/webkitgtk2.50.6-released <p>This is a bug fix release in the stable 2.50 series.</p> <h3 id="whats-new-in-the-webkitgtk-2506-release">What’s new in the WebKitGTK 2.50.6 release?</h3> <ul> <li>Fix sample code included in the documentation of the <code class="language-plaintext highlighter-rouge">webkit_user_content_manager_register_script_message_handler()</code> function.</li> <li>Fix MP4 muxing when using GStreamer 1.28.</li> <li>Fix WebAudio not resuming correctly after using <code class="language-plaintext highlighter-rouge">window.alert()</code>.</li> <li>Fix WebAudio producing incorrect output in some cases due to incorrect sample buffer management.</li> <li>Fix several crashes and rendering issues.</li> </ul> <p>Thanks to all the contributors who made possible this release.</p>