The WebKitGTK Project

WebKitGTK 2.53.90 released!

2026-08-07T00:00:00+00:00

This is a development release leading toward 2.54 series.

What’s new in the WebKitGTK 2.53.90 release?

Do not support rendering tiles in the main thread in accelerated compositing mode.
Add magnification property to WebKitWebView to handle visual scaling.
Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
Improved platform media queries to handle prefers reduced motion, high contrast and dark theme.
Fix several crashes and rendering issues.
Translation updates: Brazilian Portuguese, Slovenian.

Thanks to all the contributors who made possible this release.

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0004

2026-07-10T00:00:00+00:00

Date Reported: July 10, 2026
Advisory ID: WSA-2026-0004
CVE identifiers: CVE-2024-4367, CVE-2026-39872, CVE-2026-43663, CVE-2026-43676, CVE-2026-43699, CVE-2026-43701, CVE-2026-43705, CVE-2026-43707, CVE-2026-43712, CVE-2026-43713, CVE-2026-43715, CVE-2026-43716, CVE-2026-43720, CVE-2026-43721, CVE-2026-43725, CVE-2026-43726, CVE-2026-43727, CVE-2026-43731, CVE-2026-43732, CVE-2026-43734, CVE-2026-43740, CVE-2026-43742, CVE-2026-43745

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2024-4367
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Thomas Rinsma of Codean Labs.
- Impact: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. Description: The issue was addressed with improved checks.
CVE-2026-39872
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Utkarsh Pal, Ignacio Sanmillan (@ulexec).
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 313528
CVE-2026-43663
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda, HexRabbit (@h3xr4bb1t) and NiNi (@terrynini38514) of DEVCORE Research Team, Using GLM From Z.AI, Tristan Madani (@TristanInSec) from Talence Security, Brian Carpenter.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 312781
CVE-2026-43676
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Mateusz Krzywicki (iVerify.io), dr3dd, Tommy DeVoss from Braze Security Team (@thedawgyg).
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: An out-of-bounds access issue was addressed with improved bounds checking.
- WebKit Bugzilla: 317231
CVE-2026-43699
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Tommy DeVoss from Braze Security Team (@thedawgyg).
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 317227
CVE-2026-43701
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Aaron Grattafiori - NVIDIA AI Red Team.
- Impact: A malicious website may be able to process restricted web content outside the sandbox. Description: The issue was addressed with improved checks.
- WebKit Bugzilla: 315004
CVE-2026-43705
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to dr3dd.
- Impact: Processing maliciously crafted web content may lead to memory corruption. Description: A type confusion issue was addressed with improved checks.
- WebKit Bugzilla: 314528
CVE-2026-43707
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A memory corruption issue was addressed with improved memory handling.
- WebKit Bugzilla: 315951
CVE-2026-43712
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Kwak Kiyong, Song Nuri, Tristan Madani (@TristanInSec) from Talence Security.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 314235
CVE-2026-43713
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Jody Ritonga.
- Impact: Visiting a website may leak sensitive data. Description: A permissions issue was addressed with additional restrictions.
- WebKit Bugzilla: 314806
CVE-2026-43715
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Milad Nasr and Nicholas Carlini with Claude, Anthropic.
- Impact: Processing maliciously crafted web content may lead to memory corruption. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313577
CVE-2026-43716
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Tuan and Duc from Calif.io, OpenAI Codex Security - Amy Burnett, Evan Lambert.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 313473
CVE-2026-43720
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Gia Bui (@yabeow) from Calif.io, Josef Korbel.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313175
CVE-2026-43721
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Idan Masas.
- Impact: A malicious website may be able to silently hijack clipboard data. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 313478
CVE-2026-43725
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Luke Francis.
- Impact: A malicious website may be able to process restricted web content outside the sandbox. Description: The issue was addressed with improved input validation.
- WebKit Bugzilla: 312832
CVE-2026-43726
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Josef Korbel (Citadelo), Tristan Madani (@TristanInSec) from Talence Security, Gia Bui (@yabeow) from Calif.io, Narendra Singh (@_3P1C).
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313857
CVE-2026-43727
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Tommy DeVoss from Braze Security Team (@thedawgyg), Gia Bui (@yabeow) from Calif.io, Gurpreet Shergill.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313691
CVE-2026-43731
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to dr3dd.
- Impact: Processing maliciously crafted web content may lead to memory corruption. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 314115
CVE-2026-43732
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Nan Wang (@eternalsakura13).
- Impact: Processing maliciously crafted web content may disclose sensitive user information. Description: A path handling issue was addressed with improved validation.
- WebKit Bugzilla: 313085
CVE-2026-43734
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Jonathan Alush-Aben.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313693
CVE-2026-43740
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Nathaniel Oh (@calysteon), Arni Hardarson.
- Impact: Processing maliciously crafted web content may result in the disclosure of process memory. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 308046
CVE-2026-43742
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to Юлия Мерцалова.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 315161
CVE-2026-43745
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to OpenAI Codex Security - Amy Burnett, Khai Tran.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: An out-of-bounds write issue was addressed with improved input validation.
- WebKit Bugzilla: 315365

We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.

Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html or wpewebkit.org/security.

WebKitGTK 2.52.5 released!

2026-07-09T00:00:00+00:00

This is a bug fix release in the stable 2.52 series.

What’s new in the WebKitGTK 2.52.5 release?

Fire scrollend event for instant programmatic scrolls.
Increase network idle connection timeout to 115 seconds.
Add User-Agent quirk for HBO Max.
Fix the build with system malloc.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.53.4 released!

2026-06-23T00:00:00+00:00

This is a development release leading toward 2.54 series.

What’s new in the WebKitGTK 2.53.4 release?

Implemented batched painting in skia compositor, which improves performance when there are many layers that can be painted in the same operation.
Avoid unnecessary clips when possible in skia compositor.
Fix synchronization issues between main, scrolling and compositing threads causing glitches while scrolling in some cases.
Limit the damage region of the scrollbar to the region actually painted.
Add support for image/webp to canvas.toDataURL().
Expose search inputs as WEBKIT_INPUT_PURPOSE_SEARCH.
Add User-Agent quirk for HBO Max.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.52.4 released!

2026-06-02T00:00:00+00:00

This is a bug fix release in the stable 2.52 series.

What’s new in the WebKitGTK 2.52.4 release?

Add support for half-width fonts.
Improve content filter compilation by avoiding file copies.
Improve handling of out of disk space conditions when the NetworkProcess tried to write data in caches.
Improve how the CMake build system checks whether libatomic is required.
Fix painting scrollbars when their width changes.
Fix playback of certain YouTube videos with low frame rates.
Fix webkit://gpu not working in systems where neither libGL.so.1 nor libOpenGL.so.0 are available.
Fix the build with librice 0.4 or newer when the GStreamer WebRTC backend is enabled at build configuration time.
Fix the build with USE_GSTREAMER_WEBRTC=OFF.
Fix the build with USE_GBM=OFF.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0003

2026-06-02T00:00:00+00:00

Date Reported: June 02, 2026
Advisory ID: WSA-2026-0003
CVE identifiers: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658, CVE-2026-43660

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2026-28847
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to DARKNAVY (@DarkNavyOrg), Anonymous working with TrendAI Zero Day Initiative, Daniel Rhea.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 308707
CVE-2026-28883
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to kwak kiyong / kakaogames.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313939
CVE-2026-28901
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Aisle offensive security research team (Joshua Rogers, Luigino Camastra, Igor Morgenstern, and Guido Vranken), Maher Azzouzi, Ngan Nguyen of Calif.io.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 310207
CVE-2026-28902
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Tristan Madani (@TristanInSec) from Talence Security, Nathaniel Oh (@calysteon).
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 309861
CVE-2026-28903
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Mateusz Krzywicki (iVerify.io).
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 310303
CVE-2026-28904
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Luka Rački.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 309601
CVE-2026-28905
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 308545
CVE-2026-28907
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Cantina.
- Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: The issue was addressed with improved input validation.
- WebKit Bugzilla: 308675
CVE-2026-28942
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Milad Nasr and Nicholas Carlini with Claude, Anthropic.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 312180
CVE-2026-28946
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Gia Bui (@yabeow) from Calif.io, dr3dd, w0wbox.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 310544
CVE-2026-28947
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to dr3dd.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 310234
CVE-2026-28953
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Maher Azzouzi.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 309628
CVE-2026-28955
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to wac and Kookhwan Lee working with TrendAI Zero Day Initiative.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 310880
CVE-2026-28958
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Cantina.
- Impact: An app may be able to access sensitive user data. Description: This issue was addressed with improved data protection.
- WebKit Bugzilla: 311228
CVE-2026-43658
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Do Young Park.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 307669
CVE-2026-43660
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Cantina.
- Impact: Processing maliciously crafted web content may prevent Content Security Policy from being enforced. Description: A validation issue was addressed with improved logic.
- WebKit Bugzilla: 308906

Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html or wpewebkit.org/security.

WebKitGTK 2.53.3 released!

2026-05-28T00:00:00+00:00

This is a development release leading toward 2.54 series.

What’s new in the WebKitGTK 2.53.3 release?

Switch web process compositor to use Skia instead of TextureMapper.
Fix missing glyph before ZWJ/ZWNJ if no font is found for the cluster.
Add support for half width fonts.
Support time zone change notifications on linux.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.53.2 released!

2026-05-06T00:00:00+00:00

This is a development release leading toward 2.54 series.

What’s new in the WebKitGTK 2.53.2 release?

Only use DMA-BUF mapping for writing to the GPU atlas when possible.
Do not resolve ‘-apple-system’ font to default system font.
Set real time limits when not using the portal.
Report support for supported non-AAC mp4a codecs.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.53.1 released!

2026-04-17T00:00:00+00:00

This is the first development release leading toward 2.54 series.

What’s new in the WebKitGTK 2.53.1 release?

Remove the option to use cairo for 2D rendering.
Implement GPU atlas creation and replay substitution for batched raster image uploads.
Improved non accelerated composited mode by using the same buffer sharing implementation as accelerated mode.
The on-demand hardware acceleration policy is now deprecated in GTK3 API.
Add new improved API for page favicons.
Add webkit_feature_list_find() to public API.
Support PGO features in regular CMake builds.
Fix several crashes and rendering issues.

Thanks to all the contributors who made possible this release.

WebKitGTK 2.52.3 released!

2026-04-16T00:00:00+00:00

This is a bug fix release in the stable 2.52 series.

What’s new in the WebKitGTK 2.52.3 release?

Add support for the “scrollbar-color” CSS property.
Fix some emoji glyphs being rendered as missing glyph boxes.
Fix JavaScriptCore crashes on architectures other than x86_64.
Fix the build on s390x.
Fix several crashes and rendering issues.
Translation updates: Serbian.

Thanks to all the contributors who made possible this release.