Description
A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ubuntu | Oxide | unspecified – < 1.18.3 | 1.18.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | oxide-qt | 1.18.3-0ubuntu0.16.04.1 | USN-3113-1 |
| Ubuntu 14.04 LTS | oxide-qt | 1.18.3-0ubuntu0.14.04.1 | USN-3113-1 |
Advisories 1
- USN-3113-1 oxide-qt vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026