Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-43804 EUVD-2026-49434GHSA-mj89-jhh3-3x9r

This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6,…

Published Jul 27, 2026 · Updated Jul 28, 2026 · Assigned by apple

Vendor: Apple Product: iOS and iPadOS Product: macOS Product: Safari Product: visionOS Package: qtwebkit-opensource-src Package: qtwebkit-source Package: webkit2gtk Package: webkit2gtk Package: webkitgtk Package: wpewebkit Package: wpewebkit Platform: iOS Platform: macOS Category: Browsers Ecosystem: Debian Ecosystem: Ubuntu

Description

This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. Visiting a website may lead to an app denial-of-service.

Affected products

VendorProductAffectedFixed
Apple Safari < 26.6 26.6
Apple iOS and iPadOS < 26.6 26.6
Apple macOS < 26.6 26.6
Apple visionOS < 26.6 26.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 wpewebkit +1 2.52.6-1 —
Debian 13 webkit2gtk 2.52.6-1~deb13u1 —
Debian 13 wpewebkit No fix yet —
Debian 12 wpewebkit +1 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS webkit2gtk 2.52.6-0ubuntu0.26.04.1 USN-8703-1
Ubuntu 24.04 LTS qtwebkit-opensource-src No fix yet —
Ubuntu 24.04 LTS webkit2gtk 2.52.6-0ubuntu0.24.04.1 USN-8703-1
Ubuntu 22.04 LTS wpewebkit +2 No fix yet —
Ubuntu 20.04 LTS wpewebkit +2 No fix yet —
Ubuntu 18.04 LTS webkitgtk +3 No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS webkitgtk +3 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 webkit2gtk3 +3 2.54.0-1.el9_8 RHSA-2026:69098
RHEL 8 webkit2gtk3 +3 2.54.0-1.el8_10 RHSA-2026:74084

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 webkit2gtk3 +3 2.54.0-1.el9_8 ALSA-2026:69098
AlmaLinux 8 webkit2gtk3 +3 2.54.0-1.el8_10 ALSA-2026:74084

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 webkit2gtk3 2.54.0-1.el9_8 RLSA-2026:69098
Rocky Linux 8 webkit2gtk3 2.54.0-1.el8_10 RLSA-2026:74084

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 webkit2gtk3 +2 2.52.6-150600.12.74.1 SUSE-SU-2026:4020-1
SLES 15 SP5 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLES 15 SP4 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 webkit2gtk3 +1 2.54.1-160000.1.1 SUSE-SU-2026:24225-1
SLES for SAP 15 SP5 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLES for SAP 15 SP4 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLES 16.0 webkit2gtk3 +1 2.54.1-160000.1.1 SUSE-SU-2026:24225-1
SLE HPC 15 SP5 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1
SLE HPC 15 SP4 webkit2gtk3 +2 2.52.6-150400.4.149.2 SUSE-SU-2026:4001-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 webkit2gtk3 +2 2.54.1-160000.1.1 openSUSE-SU-2026:22076-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 webkitgtk4 +3 2.52.6-1.amzn2 ALAS2-2026-3891

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 webkit2gtk3 +3 2.54.0-1.el9_8 ELSA-2026-69098
Oracle Linux 8 webkit2gtk3 +3 2.54.0-1.el8_10 ELSA-2026-74084

Advisories 20

References