CVE-2026-78376
Received Received - Intake

Use-After-Free Memory Corruption in WebKitGTK

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: redhat-SADP

Description
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78376
EUVD
EUVD-2026-64858

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
webkitgtk webkitgtk3 *
webkitgtk webkitgtk4 *
webkitgtk webkitgtk *
igalia webkitgtk *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free flaw in WebKitGTK, a web browser engine. Processing malicious web content can cause improper memory handling, leading to memory corruption. This may allow attackers to execute arbitrary code or crash applications.

Detection Guidance

Detecting this vulnerability typically involves checking for vulnerable versions of WebKitGTK. Use package managers like 'dnf list installed webkitgtk*' or 'apt list --installed | grep webkitgtk' to identify installed versions. Monitor for crashes or memory corruption in applications using WebKitGTK, such as GNOME Shell or Evolution.

Impact Analysis

An attacker could trick you into loading malicious web content, potentially leading to arbitrary code execution, application crashes, or data leaks. On Linux systems using GNOME, remote attackers on the same network could exploit it without user interaction.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to its potential for memory corruption, arbitrary code execution, and data leakage when processing malicious web content. Exploitation may lead to unauthorized access to sensitive data, which is a concern for both regulations. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. The flaw's ability to crash processes or leak data could violate these requirements if exploited.

Mitigation Strategies

Avoid processing untrusted web content with WebKitGTK. Remove vulnerable packages like WebKitGTK4 if not required. For Red Hat Enterprise Linux 7, consider removing packages like evolution-data-server or gnome-shell if they rely on WebKitGTK for untrusted content. WebKitGTK3 can be safely removed without breaking functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart