State Issues in WPE WebKit and WebKitGTK+ - CVE-2026-28861

Vulnerability identifier: #VU124401

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2026-28861

CWE-ID: CWE-371

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper handling of web content in WebKit when processing malicious web pages. A remote attacker can entice the victim to visit a specially crafted website and access script message handlers intended for other origins.

WPE WebKit
WebKitGTK+
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Development Tools Module
Desktop Applications Module
Basesystem Module
openSUSE Leap
iPadOS
Apple iOS
Ubuntu
macOS
visionOS
Apple Safari
webkit2gtk (Debian package)
webkit2gtk3-devel
libwebkit2gtk3-lang
webkit2gtk-4_0-injected-bundles-debuginfo
libwebkit2gtk-4_0-37-debuginfo
webkit2gtk-4_0-injected-bundles
libwebkit2gtk-4_0-37
libjavascriptcoregtk-4_0-18-debuginfo
typelib-1_0-WebKit2WebExtension-4_0
typelib-1_0-JavaScriptCore-4_0
typelib-1_0-WebKit2-4_0
webkit2gtk3-debugsource
libjavascriptcoregtk-4_0-18
webkit2gtk3-soup2-minibrowser-debuginfo
webkit2gtk3-soup2-debugsource
webkit-jsc-6.0-debuginfo
webkit-jsc-4.1-debuginfo
webkitgtk-6_0-injected-bundles-debuginfo
libjavascriptcoregtk-6_0-1-debuginfo
libjavascriptcoregtk-4_1-0-debuginfo
typelib-1_0-WebKit2WebExtension-4_1
libjavascriptcoregtk-6_0-1
libjavascriptcoregtk-4_1-0
typelib-1_0-JavaScriptCore-4_1
webkit2gtk3-soup2-minibrowser
webkit2gtk-4_1-injected-bundles-debuginfo
typelib-1_0-JavaScriptCore-6_0
webkit-jsc-4
webkit2gtk4-devel
webkit2gtk4-debugsource
libwebkitgtk-6_0-4-debuginfo
webkit2gtk4-minibrowser
webkit-jsc-4-debuginfo
WebKitGTK-4.0-lang
WebKitGTK-6.0-lang
WebKitGTK-4.1-lang
libwebkit2gtk-4_0-37-64bit-debuginfo
libjavascriptcoregtk-4_0-18-64bit
libwebkit2gtk-4_1-0-64bit
webkit-jsc-4.1
libjavascriptcoregtk-4_0-18-64bit-debuginfo
libjavascriptcoregtk-4_1-0-64bit
libwebkit2gtk-4_0-37-64bit
libwebkit2gtk-4_0-37-32bit
libjavascriptcoregtk-4_1-0-32bit-debuginfo
libjavascriptcoregtk-4_1-0-32bit
libwebkit2gtk-4_1-0-32bit-debuginfo
libjavascriptcoregtk-4_0-18-32bit
libwebkit2gtk-4_1-0-32bit
libjavascriptcoregtk-4_0-18-32bit-debuginfo
libwebkit2gtk-4_0-37-32bit-debuginfo
webkit-jsc-6.0
webkit2gtk3-soup2-devel
webkit2gtk3-minibrowser-debuginfo
libjavascriptcoregtk-4_1-0-64bit-debuginfo
webkit2gtk3-minibrowser
webkitgtk-6_0-injected-bundles
typelib-1_0-WebKitWebProcessExtension-6_0
typelib-1_0-WebKit-6_0
typelib-1_0-WebKit2-4_1
webkit2gtk-4_1-injected-bundles
libwebkit2gtk-4_1-0-debuginfo
webkit2gtk4-minibrowser-debuginfo
libwebkit2gtk-4_1-0
libwebkitgtk-6_0-4
libwebkit2gtk-4_1-0-64bit-debuginfo
webkit2gtk (Ubuntu package)

Install update from vendor's website.

WPE WebKit - update to 2.52.1
WebKitGTK+ - update to 2.52.1
iPadOS - addressed in versions 18.7.7 22H333, 26.4 23E246
Apple iOS - addressed in versions 18.7.7 22H333, 26.4 23E246
macOS - update to 26.4 25E246
Apple Safari - update to 26.4
visionOS - update to 26.4
webkit2gtk (Debian package) - update to 2.52.1-1~deb13u1
webkit2gtk3-devel - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk3-lang - update to 2.52.1-4.57.1
webkit2gtk-4_0-injected-bundles-debuginfo - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_0-37-debuginfo - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk-4_0-injected-bundles - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_0-37 - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_0-18-debuginfo - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-WebKit2WebExtension-4_0 - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-JavaScriptCore-4_0 - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-WebKit2-4_0 - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk3-debugsource - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_0-18 - addressed in versions 2.52.1-4.57.1, 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk3-soup2-minibrowser-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk3-soup2-debugsource - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit-jsc-6.0-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit-jsc-4.1-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkitgtk-6_0-injected-bundles-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-6_0-1-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_1-0-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-WebKit2WebExtension-4_1 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-6_0-1 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_1-0 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-JavaScriptCore-4_1 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk3-soup2-minibrowser - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk-4_1-injected-bundles-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-JavaScriptCore-6_0 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit-jsc-4 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk4-devel - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk4-debugsource - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkitgtk-6_0-4-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk4-minibrowser - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit-jsc-4-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
WebKitGTK-4.0-lang - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
WebKitGTK-6.0-lang - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
WebKitGTK-4.1-lang - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_0-37-64bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_0-18-64bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_1-0-64bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit-jsc-4.1 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_0-18-64bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_1-0-64bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_0-37-64bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_0-37-32bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_1-0-32bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_1-0-32bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_1-0-32bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_0-18-32bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_1-0-32bit - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_0-18-32bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_0-37-32bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit-jsc-6.0 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk3-soup2-devel - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk3-minibrowser-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libjavascriptcoregtk-4_1-0-64bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk3-minibrowser - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkitgtk-6_0-injected-bundles - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-WebKitWebProcessExtension-6_0 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-WebKit-6_0 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
typelib-1_0-WebKit2-4_1 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk-4_1-injected-bundles - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_1-0-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk4-minibrowser-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_1-0 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkitgtk-6_0-4 - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
libwebkit2gtk-4_1-0-64bit-debuginfo - addressed in versions 2.52.1-150400.4.140.2, 2.52.1-150600.12.63.1
webkit2gtk (Ubuntu package) - addressed in versions 2.52.3-0ubuntu0.24.04.1, 2.52.3-0ubuntu0.25.10.1, 2.52.3-0ubuntu0.26.04.2

• https://support.apple.com/en-us/126794
• https://webkitgtk.org/security/WSA-2026-0002.html

• Multiple vulnerabilities in WebKitGTK+ and WPE WebKit
• Multiple vulnerabilities in Apple macOS Tahoe
• Multiple vulnerabilities in Apple Safari
• Multiple vulnerabilities in Apple iOS 18 and iPadOS 18
• Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
• Multiple vulnerabilities in Apple visionOS
• SUSE update for webkit2gtk3
• SUSE update for webkit2gtk3
• Ubuntu update for webkit2gtk
• SUSE update for webkit2gtk3
• Debian update for webkit2gtk