WPEwebkit.org

WPE WebKit 2.54.1 released

2026-10-06T00:00:00Z

This is the first bug fix release in the stable 2.54 series.

What’s new in WPE WebKit 2.54.1?

Allow pasting in-memory image data from clipboard.
Add User-Agent quirk for Amazon Luna.
Handle scrolling through touch input asynchronously.
Align the filter surface with the device pixel grid.
Do not rasterize the part of a tile that the clip drops.
Fix rendering of scaled or transformed no-repeat background images.
Fix rendering of preserve-3d layers when a layer crosses the camera plane.
Fix SkiaCompositingLayer filter rendering under transforms.
Fix the WPEPlatform built-in Wayland support with libwayland-client 1.25 or newer.
Fix the build with ENABLE_WPE_1_1_API enabled.
Fix text deleted by input method delete-surrounding in contenteditable.
Fix the inputmode attribute being ignored for <input> elements.
Fix input methods not updated when refocusing elements in some cases.
Fix caret position reporting to input methods during pre-edit.
Fix memory usage thresholds not being reached due to incorrect memory footprint calculation.
Fix the build with PGO profile instrumentation enabled when using the GNU linker (ld.bfd).
Fix several crashes and rendering issues.

Checksums

wpewebkit-2.54.1.tar.xz (44.1 MiB)
   md5sum: 834129000777bef051f2587ab069a6b5
   sha1sum: 2337fce302aae017cf3ff699987cb258eb7c9260
   sha256sum: 0de8bdfba011f9cd63ba9a9171fa6038dd2c08237894f4082abbb821f29d3fe9

WPEPlatform: the new WPE API

2026-10-06T00:00:00Z

With the 2.54 release, WPEPlatform became the default way of integrating WPE WebKit with the underlying platform, and its API is now considered stable. At the same time, the libwpe-based API that WPE has relied on since its beginnings is now deprecated. In this article we explain why this change was made, how applications use the new API, and what is involved in migrating an existing application from libwpe.

Back in 2022 we published an overview of the WPE WebKit project, describing the different components of WPE and how they fit together. Most of what that article explains about WebKit and the WPE API is still valid, but the way WPE connects to the platform has changed considerably since then, so this is a good moment to revisit that part of the picture.

How WPE used to integrate with the platform

Since its beginnings, WPE has delegated graphics and input to code that lives outside of WebKit. libwpe defined a generic interface for these, and a backend, loaded at runtime, implemented that interface for a given platform. WPEBackend-fdo, based on Wayland and other freedesktop.org technologies, was the reference backend, while Cog provided a convenience layer on top for those writing browsers.

This design achieved its main goal: hardware vendors and integrators could support WPE on their platforms without having to modify WebKit itself. However, it also meant that a good part of the platform work was left to the application. To show a web page on screen using WPEBackend-fdo, an application had to:

Load a libwpe backend with wpe_loader_init() and initialize it, usually by passing it an EGL display.
Create a view backend through the “exportable” API of WPEBackend-fdo, wrap it in a WebKitWebViewBackend, and pass that to the web view.
Receive, in a set of callbacks, the buffers exported by WebKit for each frame, present them on screen, release them, and notify WebKit when the frame had been displayed.
Collect input events from the windowing system and forward them to WebKit with the wpe_view_backend_dispatch_*_event() family of functions.

As a result, even a simple browser required a fair amount of knowledge of the graphics pipeline, and the code involved was split across three repositories (WebKit, libwpe, and WPEBackend-fdo) that had to be kept in sync. Much of this code was the same from one application to the next, and Cog provided a ready-made implementation of it for applications that did not want to write their own.

What WPEPlatform changes

WPEPlatform is a GObject-based library that lives in the WebKit repository and is built as part of WPE WebKit. It replaces both libwpe and the backends written against it, and it moves the responsibility of rendering and input handling away from the application and into WebKit and the platform implementation.

The library is only used by WebKit’s UI process. As before, the web process renders the page into buffers that are shared with the UI process (DMA-BUF buffers on Linux, AHardwareBuffer on Android, or shared memory when rendering in software). The difference is that WebKit now hands these buffers directly to the platform implementation, which takes care of presenting them, without the application having to take part in the process.

The API is built around four classes:

WPEDisplay: the connection to the platform, and the object that creates all the others.
WPEToplevel: a top-level surface, which is normally a window, or the whole output on platforms that have no windows.
WPEView: the surface where a single web view is rendered, hosted in a toplevel. It also receives the input events for that web view.
WPEBuffer: the pixel data produced by WebKit and handed to the view, with a subclass for each type of buffer.

These are complemented by smaller classes for screens, keymaps, settings, input methods, gestures, gamepads, the clipboard, and accessibility. Several of them, such as screens, settings, input methods, and gestures, had no equivalent in libwpe.

WPE WebKit ships with three built-in platform implementations: Wayland, DRM/KMS (for devices that drive the display directly, without a compositor), and headless (for testing and offscreen rendering). Other implementations can be developed out of tree and installed as modules, which WPE WebKit discovers at runtime. wpe-platform-gtk, which embeds WPE web views in GTK 4 applications, is an example of this.

Using WPEPlatform in an application

For most applications, WPEPlatform is not visible at all. A WebKitWebView created without a backend selects a platform automatically: WPE WebKit tries the available platform implementations in order of priority and uses the first one that connects successfully. The following program is a complete, if minimal, browser:

#include <wpe/webkit.h>
#include <wpe/wpe-platform.h>

static void
on_view_closed (WPEView *view, gpointer user_data)
{
    g_main_loop_quit (user_data);
}

int
main (int argc, char *argv[])
{
    g_autoptr(GMainLoop) loop = g_main_loop_new (NULL, FALSE);
    g_autoptr(WebKitWebView) web_view = g_object_new (WEBKIT_TYPE_WEB_VIEW, NULL);

    WPEView *view = webkit_web_view_get_wpe_view (web_view);
    g_signal_connect (view, "closed", G_CALLBACK (on_view_closed), loop);

    webkit_web_view_load_uri (web_view, argc > 1 ? argv[1] : "https://wpewebkit.org");
    g_main_loop_run (loop);

    return 0;
}

It only needs the wpe-webkit-2.0 pkg-config module to build, which pulls in wpe-platform-2.0 when WPE WebKit is built with WPEPlatform support (the default since 2.54). Note that the closed signal is emitted when the user closes the window, and of the built-in platforms, only Wayland emits it. On DRM and headless the application decides by itself when to exit.

The platform API comes into play when an application needs more than these defaults. The most common cases are the following.

Choosing a platform. The WPE_PLATFORM environment variable (wayland, drm, or headless) forces a given platform without any changes to the code. An application that is meant to run on a single platform can also create the display itself and pass it to the web view:

#include <wpe/wayland/wpe-wayland.h>

g_autoptr(GError) error = NULL;
g_autoptr(WPEDisplay) display = wpe_display_wayland_new ();
if (!wpe_display_connect (display, &error))
    g_error ("Could not connect to Wayland: %s", error->message);

WebKitWebView *web_view = g_object_new (WEBKIT_TYPE_WEB_VIEW,
                                        "display", display,
                                        NULL);

The Wayland-specific API is available with the same wpe-webkit-2.0 module, but an application that depends on it can check for the wpe-platform-wayland-2.0 pkg-config module, which is only installed when WPE WebKit is built with the Wayland platform enabled. The DRM and headless implementations work the same way, with wpe_display_drm_new() and wpe_display_headless_new().

Handling input. Input events are delivered to the WPEView through the event signal before they reach the web page. An application can connect to it to implement keyboard shortcuts, returning TRUE to stop the event from reaching the page:

static gboolean
on_view_event (WPEView *view, WPEEvent *event, gpointer user_data)
{
    if (wpe_event_get_event_type (event) == WPE_EVENT_KEYBOARD_KEY_DOWN
        && (wpe_event_get_modifiers (event) & WPE_MODIFIER_KEYBOARD_CONTROL)
        && wpe_event_keyboard_get_keyval (event) == WPE_KEY_q) {
        g_main_loop_quit (user_data);
        return TRUE;
    }
    return FALSE;
}

g_signal_connect (view, "event", G_CALLBACK (on_view_event), loop);

Controlling the window. The toplevel that hosts the view is available through wpe_view_get_toplevel(), and provides functions to set the title (wpe_toplevel_set_title()), resize, maximize, or switch to fullscreen (wpe_toplevel_fullscreen()). Changes in its state are reported by the toplevel-state-changed signal of the view. How much of this is supported depends on the platform: Wayland implements all of it, the headless implementation only keeps track of size and fullscreen state, and DRM does not support them, since its toplevel always covers the whole screen.

Finally, wpe_display_get_settings() gives access to WPESettings, where applications can override platform settings such as the dark mode preference, reduced motion, or contrast. The prefers-color-scheme, prefers-reduced-motion, and prefers-contrast CSS media queries follow these settings.

Migrating from libwpe

For an application, most of the migration consists of removing code. With WPEBackend-fdo, creating a web view looked roughly like this, with most of the actual work happening in the callbacks of exportable_client:

struct wpe_view_backend_exportable_fdo *exportable =
    wpe_view_backend_exportable_fdo_egl_create (&exportable_client, app, width, height);
struct wpe_view_backend *wpe_backend =
    wpe_view_backend_exportable_fdo_get_view_backend (exportable);
WebKitWebViewBackend *backend =
    webkit_web_view_backend_new (wpe_backend, destroy_backend, exportable);
WebKitWebView *web_view = webkit_web_view_new (backend);

With WPEPlatform, the same is achieved with a single line:

WebKitWebView *web_view = g_object_new (WEBKIT_TYPE_WEB_VIEW, NULL);

webkit_web_view_new() is only available when WPE WebKit is built with the legacy API, so applications need to switch to g_object_new(). The rest of the application code that uses the WebKit API (settings, network sessions, navigation, and so on) does not need any changes. The diagram below summarizes what moves out of the application:

The rest of the libwpe code in an application maps to WPEPlatform as follows:

libwpe / WPEBackend-fdo	WPEPlatform
`wpe_loader_init()` and backend initialization	Automatic, or `WPE_PLATFORM`, or creating a `WPEDisplay`
Exportable client callbacks, buffer release, frame completion	Handled by WebKit and the platform implementation
`wpe_view_backend_dispatch_*_event()`	Handled by the platform; intercept with the `WPEView::event` signal
Fullscreen handler	`wpe_toplevel_fullscreen()` and the toplevel state

There are a few things in libwpe and WPEBackend-fdo that have no equivalent in WPEPlatform. The process provider API of libwpe is gone, since WebKit is again in charge of launching its auxiliary processes. The only exception is Android, which has its own WPEProcessManager API. The audio extension of WPEBackend-fdo has not been supported since 2.46, and the video plane extension, used to display video frames on hardware overlay planes, has no equivalent yet.

Those who maintain a custom backend for WPEBackend-fdo, rather than an application, will need to port it to a WPEPlatform implementation. This means subclassing WPEDisplay, WPEToplevel, and WPEView, and optionally the input method, keymap, and screen classes. The tutorial on writing a platform implementation covers this in detail. In many cases, extending one of the built-in implementations might be enough: the Wayland one, for example, exposes its wl_display, wl_compositor, and wl_surface objects, which makes it possible to add support for additional Wayland protocols.

On the build side, the legacy API is still built by default in 2.54 and will continue to be maintained while applications migrate. Once an application no longer needs it, it can be disabled at build time with the ENABLE_WPE_LEGACY_API=OFF CMake option. As for Cog, it will not have further stable releases beyond the 0.18.x series, so we recommend that new applications use the WebKit and WPEPlatform APIs directly.

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006

2026-09-29T00:00:00Z

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2024-1283
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2024-43091
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-43097
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-43767
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-43768
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-7966
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High).
CVE-2024-8193
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2024-8198
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2024-8636
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2024-9123
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High).
CVE-2025-0436
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2025-0444
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2025-10502
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High).
CVE-2025-26416
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-32318
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- In Skia, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-48622
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-54627
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out-of-bounds write vulnerability in the skia module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-8901
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High).
CVE-2025-9478
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-0908
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-10009
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10011
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10012
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10018
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-10019
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-10881
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-10883
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-10889
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-10907
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10919
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10941
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10974
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10977
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10979
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10985
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-10993
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-10994
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11004
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11024
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11039
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11040
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11051
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11057
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11061
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11065
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11066
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11087
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11088
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11090
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11104
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11109
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11110
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11111
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11113
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11121
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11123
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11124
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11137
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11138
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11159
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11191
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-11663
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-11675
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-13780
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-13781
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-13834
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-13841
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-13859
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-13877
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-13883
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-13971
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-14044
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-14125
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-14152
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-14382
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14386
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14387
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-14388
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-14389
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-14390
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14396
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14398
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-14400
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14410
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-14411
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14412
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14413
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14414
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-14418
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14419
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-14425
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-14427
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-14429
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-15109
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-15766
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-15774
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-16413
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-16417
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17653
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-17655
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-17667
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17668
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17671
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17675
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17678
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17682
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17683
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17687
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17689
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17697
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17702
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17704
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17714
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17717
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17718
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17721
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-17740
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17745
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17750
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17757
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17771
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17785
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17801
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17832
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17847
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-17914
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Side-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-19160
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-19161
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-19173
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-19176
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-3536
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-3538
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-3909
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High).
CVE-2026-3931
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-43670
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to lebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab.
- Impact: Processing maliciously crafted web content may bypass Content Security Policy. Description: A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts.
- WebKit Bugzilla: 309004
CVE-2026-4448
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2026-4460
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High).
CVE-2026-4464
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-5283
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-5870
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-6296
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-6298
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-6364
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. (Chromium security severity: Medium).
CVE-2026-64715
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative.
- Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 316347
CVE-2026-64753
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Viggo Lekdorf.
- Impact: Processing maliciously crafted web content may disclose sensitive user information. Description: A permissions issue was addressed by removing the vulnerable code.
- WebKit Bugzilla: 315121
CVE-2026-64778
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Mohit Negi.
- Impact: Visiting a maliciously crafted website may leak sensitive data. Description: The issue was addressed with improved checks.
- WebKit Bugzilla: 322124
CVE-2026-64779
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Shubham Chaskar, Tommy DeVoss from Braze Security Team (@thedawgyg).
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: A memory corruption vulnerability was addressed with improved locking.
- WebKit Bugzilla: 321485
CVE-2026-64780
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: The issue was addressed with improved checks.
- WebKit Bugzilla: 316918
CVE-2026-64781
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Thomas Guillem.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: The issue was addressed with improved input validation.
- WebKit Bugzilla: 321484
CVE-2026-64782
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Charles Kern, Shubham Chaskar, Seonwook Kim, lattice, Josef Korbel.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: A memory corruption vulnerability was addressed with improved locking.
- WebKit Bugzilla: 321480
CVE-2026-64784
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Janggoon Lee of Out of Bounds, OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: An out-of-bounds access issue was addressed with improved bounds checking.
- WebKit Bugzilla: 317632
CVE-2026-65331
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 317611
CVE-2026-65332
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Kun Peeks (@SwayZGl1tZyyy), OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 317450
CVE-2026-65333
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 317603
CVE-2026-65334
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: A memory corruption issue was addressed with improved state management.
- WebKit Bugzilla: 316791
CVE-2026-65336
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Josef Korbel.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 317349
CVE-2026-65337
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 317142
CVE-2026-65338
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to OpenAI Codex Security - Amy Burnett.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 318348
CVE-2026-65340
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Josef Korbel (Citadelo).
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 316996
CVE-2026-65341
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Henock Habte.
- Impact: Processing maliciously crafted web content may lead to memory corruption. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 318405
CVE-2026-65351
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Niels Hofmans.
- Impact: Processing maliciously crafted web content may lead to an unexpected crash. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 321517
CVE-2026-7353
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-7354
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read and write in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-7359
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-76041
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: High).
CVE-2026-78904
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-78905
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-78906
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-78914
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-78958
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross- origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-78965
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-7900
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79020
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium).
CVE-2026-79043
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79112
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-79118
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79120
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-79127
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-79130
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Buffer overflow in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79131
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79144
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-79147
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Low).
CVE-2026-79149
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79188
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79189
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-7920
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79229
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-7923
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-79269
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-79270
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-79275
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-7942
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-7943
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium).
CVE-2026-7949
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium).
CVE-2026-84635
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Souta Sugiyama.
- Impact: Processing maliciously crafted web content may lead to an unexpected process termination. Description: A logic issue was addressed with improved state management.
- WebKit Bugzilla: 310457
CVE-2026-8579
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted print file. (Chromium security severity: Medium).
CVE-2026-86898
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0.
- Credit to Tomi Garcia (archyxsec).
- Impact: Opening a maliciously crafted webarchive file may lead to universal cross-site scripting. Description: A logic issue was addressed with improved state management.
- WebKit Bugzilla: 318271
CVE-2026-9877
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-9878
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-9879
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-9882
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-9893
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical).
CVE-2026-9899
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9900
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9901
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9904
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9908
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9909
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9910
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds memory access in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9911
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9913
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9914
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9915
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9916
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9923
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9925
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9926
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9927
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9935
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9940
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9941
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9942
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9944
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9946
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9953
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9965
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9969
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9975
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Out of bounds read and write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9981
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9982
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9983
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High).
CVE-2026-9998
- Versions affected: WebKitGTK and WPE WebKit before 2.54.0 or earlier.
- Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High).

We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.

Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html or wpewebkit.org/security.

WPE WebKit 2.54.0 released

2026-09-16T00:00:00Z

This is the first stable release in the 2.54 series.

Highlights of the WPE WebKit 2.54.0 release

The WPEPlatform embedding API is now considered stable and enabled by default at build configuration time. The legacy libwpe-based API is still available, and may be deprecated in the future.
Add new API for page favicons, using WebKitFaviconDatabase and the WebKitWebView:page-icons property.
Add the WebKitWebView:magnification property, to handle visual scaling.
Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
Add support for gamepad rumble effects.
Add support for spell checking using the Enchant library.
Add initial support for the Pointer Lock API.
Switch Web Process compositor to use Skia instead of TextureMapper.
Improved WebXR implementation, which now includes support for the Layers API.
Improved damage handling that is now also used during the composition to limit the composited areas.
Implement GPU atlas creation and replay substitution for batched raster image uploads.
Media capability reporting is more accurate.
Video decoding limits are now respected in media capabilities queries.
Remove the option to use Cairo for 2D rendering.

For more details about all the changes included in WPE WebKit 2.54 see the NEWS file that is included in the tarball.

Checksums

wpewebkit-2.54.0.tar.xz (44.1 MiB)
   md5sum: 32f6eceb21afbf620bfd756bdde856cc
   sha1sum: 9ff8fce3919fd563e2759e2e5c9b87327cfc507e
   sha256sum: efa9bcc3cb891c2d88f50eec710d9ccee71cbdf1040420361eb98c17355eb452

WPE WebKit 2.54 highlights

2026-09-16T00:00:00Z

The WebKit team at Igalia is happy to announce a new release series of WPE WebKit. This release has two main highlights: the new WPEPlatform API, now stable and enabled by default, and a web process compositor built on the Skia graphics library, replacing the TextureMapper-based one. Read on for the details on both, along with a summary of the other most noteworthy changes from the latest release cycle.

WPEPlatform: the new WPE API

WPEPlatform, the API that has been in the works for the past several release cycles, takes center stage in 2.54: it is now enabled by default and its API is considered stable, so applications can build on it without expecting breaking changes in future releases. Consequently, the traditional libwpe-based API is officially deprecated: it remains available and maintained, but new code should target WPEPlatform, and existing embedders are encouraged to plan their migration. This also applies to Cog, which will not have stable releases beyond the 0.18.x series.

The best part of the new API is how much simpler it is. Under libwpe, an application had to create a view backend (usually through WPEBackend-fdo’s “exportable” backend) and drive rendering, buffer management, and input dispatch itself through its callbacks. WPEPlatform moves all of that into WebKit and the platform implementation, so migrating an application is mostly a matter of deleting code: in the common case, the application constructs its WebKitWebView without a backend, WebKit selects a suitable platform automatically, and everything built on top of the web view carries over unchanged. The platform API only surfaces when an application wants more than the defaults: pinning to a particular platform, handling raw input events, or driving the toplevel window. Each of those is a few lines against a small GObject API rather than a set of C callbacks to implement.

To help embedders make the move, WPEPlatform is now extensively documented. The reference documentation includes an overview of the platform API (covering its relationship to libwpe and what is intentionally not part of the new API), a guide on compiling against it, a tutorial on writing a browser, and a tutorial on writing a WPE platform implementation. A guide on migrating from libwpe, with a symbol-by-symbol mapping table, walks embedders through the process step by step.

Since WPEPlatform is now built by default, the wpe-platform-2.0 pkg-config module is available in regular builds. Conversely, the legacy API can be disabled at build time with ENABLE_WPE_LEGACY_API=OFF when it is not needed.

Additions and final adjustments

New platform APIs added this cycle include:

WPEProcessManager and WPEProcessLaunchOptions, which allow the embedder to control how the auxiliary WebKit processes are launched and terminated. This is particularly important on Android, where each process is a service that must be started with bindService(), and it removes the last reason a WPEPlatform-only build could not work there. Note that, unlike the rest of WPEPlatform, the process management API is only built when targeting Android and remains experimental: it is not yet generic enough to be enabled everywhere, and it may still change in future releases.
Gamepad rumble support, through wpe_gamepad_has_rumble() and wpe_gamepad_rumble(), with a built-in implementation based on libmanette. This enables the Gamepad API vibrationActuator for web content.
A new WPE_SETTING_OVERLAY_SCROLLBARS setting, enabled by default, which may be disabled by applications to opt into classic, always-visible scrollbars.
A new WPE_INPUT_PURPOSE_SEARCH input purpose, allowing input methods to detect when the values of an input field are expected to be search terms.

A few final adjustments were made to the API before declaring it stable, which may require updates to platform implementations and applications developed against the earlier previews:

The WPE_SETTING_DISABLE_ANIMATIONS setting has been replaced by WPE_SETTING_REDUCED_MOTION, matching the dedicated reduced-motion setting introduced in GNOME 50, and a new tri-state WPE_SETTING_INTERFACE_CONTRAST setting has been added. Together with the existing WPE_SETTING_DARK_MODE setting, these make the prefers-reduced-motion, prefers-contrast, and prefers-color-scheme media queries follow the platform settings.
wpe_gesture_controller_handle_event() now returns a boolean indicating whether the event was consumed.
The WPE_DMABUF_BUFFER_FORMAT environment variable has been renamed to WPE_BUFFER_FORMAT.

Beyond Linux: Android

A good measure of the new API’s maturity is wpe-android, which has been rebuilt this year as a WPEPlatform platform implementation living entirely outside the WebKit tree: Android’s display system now looks to the engine like any other WPE platform, and applications get a convenience Java API modeled after android.webkit.WebView. The new WPEProcessManager API removed the last dependency on libwpe there. You can read more about it in this post.

On the WebKit API side

The shared WebKit API has also seen additions this cycle:

A new API for page icons: webkit_favicon_database_get_page_icons() retrieves all the icons declared by a page as a list of WebKitImage objects, and the WebKitWebView:page-icons property exposes the icons of the currently loaded page. Each icon implements GLoadableIcon, so applications can pick the size that best fits their needs. With this, the favicon database is available in WPE for the first time; it can be enabled with webkit_website_data_manager_set_favicons_enabled().
A new WebKitWebView:magnification property to handle visual scaling of the page, independent of the zoom level.
WebKitWebsitePolicies:custom-user-agent allows setting a custom User-Agent for a single navigation, by passing the policies to webkit_policy_decision_use_with_policies().
webkit_feature_list_find() is a convenience function to look up a feature by identifier in a feature list.

Graphics improvements

A new Skia-based compositor

This cycle brings the largest overhaul of the rendering architecture since the adoption of Skia for 2D rendering: the web process compositor now uses the Skia API instead of the venerable TextureMapper. Layers are composed into the final frame using Skia, which allows sharing a single rendering infrastructure across the whole graphics stack and enables several optimizations:

Tile contents are recorded into deferred display lists and replayed on the compositor thread, so painting worker threads no longer need to touch the GPU at all.
Batched painting groups the drawing of many layers into a single Skia call, which improves performance on pages with many layers that can be painted in the same operation.
Unnecessary clip operations are avoided whenever possible, keeping the batched paths effective.

Beyond raw performance, expressing compositing as Skia draw calls made several features simpler and faster: filters and masks no longer require intermediate offscreen surfaces in most cases, and CSS blend modes, which TextureMapper never implemented, now work in composited layers. And since Skia can target both OpenGL and Vulkan, the compositor no longer stands in the way of Vulkan-based rendering in the future.

The new compositor also works when using the legacy libwpe-based API.

The consolidation on Skia goes beyond compositing: the option to use Cairo for 2D rendering has been removed, making Skia the only 2D rendering implementation. Rendering tiles in the main thread is no longer supported either, so threaded rendering is now the only tile painting path.

Damage-aware compositing

Damage tracking has seen substantial work this cycle. The damage is the region of the view that changed since the previous frame and therefore requires repainting; Paweł Lampe’s introduction to damage propagation covers the concept in depth. Compositing itself now uses this information: each draw the compositor issues is restricted to the damaged rectangles, in a way that preserves the batched painting described above, and damage propagation to the platform is now enabled by default. A new DamageRectangleThreshold preference allows embedders to tune the balance between damage precision and bookkeeping cost.

The performance impact

What drove the compositor rewrite was making it simpler and easier to maintain, as Carlos García Campos explained at the Web Engines Hackfest 2026; performance came later, since TextureMapper started out ahead after more than a decade of tuning. By now the optimization work has more than closed that gap. The public WPE performance dashboard, which continuously runs benchmarks on Raspberry Pi 4 devices, tells the story: comparing the last TextureMapper-based revisions against the current ones, and thus measuring the cumulative effect of the graphics work described in this section, the MotionMark score is up by around 36%. On the composition-focused variant of the benchmark, where the compositor dominates the workload, the score is up by around 45%.

The dashboard also records the GPU load during each run, and there the difference is even more telling. MotionMark increases scene complexity until the browser can no longer sustain the target frame rate, so a higher score already means more work per frame; the Skia compositor delivers that while keeping the GPU markedly less busy. On embedded devices, where the GPU is typically the scarcest resource, this headroom translates directly into smoother pages.

One part of the work goes largely unmeasured here, though. MotionMark animates nearly the entire viewport, so there is hardly anything for damage tracking to save. Real-world content behaves differently: usually a small area of the page is changing while everything else stays still, and skipping all of that quiet area cuts the per-frame GPU work to a fraction.

Other rendering improvements

A GPU atlas is now used for batched raster image uploads, regardless of the compositor in use, and it is reused across frames when the image set does not change, avoiding needless texture allocation and pixel uploads.

Asynchronous scrolling is smoother: several synchronization issues between the main, scrolling, and compositing threads that caused glitches while scrolling have been fixed, and the scrolling thread no longer blocks the compositor to flush its state, removing input-latency stalls on pages with many layers.

Finally, more animations can now run on the compositing thread: CSS animations using the steps() and linear() timing functions no longer force main-thread animation.

Better multimedia on embedded hardware, and a WebRTC transition

Let’s start with the transition: the GStreamer-based WebRTC backend is being replaced with a LibWebRTC-based implementation, which is expected to be available in the next release cycle. As a consequence, WebRTC support, which in previous releases required building with experimental features enabled, is disabled in 2.54.

The rest of the multimedia work moved forward at full speed, with a strong focus on embedded hardware:

Hardware video decoding and encoding for platforms with a Qualcomm GPU has been added, leveraging the qtic2vdec and qtic2venc GStreamer elements.
Video decoding limits are now respected in MediaCapabilities queries, and can be overridden with the WEBKIT_GST_VIDEO_DECODING_LIMIT environment variable, so a single build can serve devices with different capabilities.
Resource usage on pages containing many videos has been improved, by stopping the pipelines of muted, invisible video elements.
A new feature flag, enabled by default, allows low-end devices to skip caching pages with multimedia content in the back-forward cache, so that a suspended pipeline cannot hold a scarce hardware decoder hostage.
Media capability reporting is more accurate: non-AAC mp4a codecs (MP3, AC-3, E-AC-3) are correctly reported as supported when decoders are present, xHE-AAC support is auto-detected, and Dolby AC-4 is advertised for MSE on systems that support it.
Experimental support for SourceBuffer.changeType() has been added to the MSE backend, along with a fix for playback stalling at ad transitions on Twitch.
Persistent licenses are now supported in the Thunder CDM for encrypted media.

On top of this, the GStreamer backend has received a substantial amount of memory-safety and lifetime-correctness work that translates into a more stable multimedia experience.

WebXR

The OpenXR-based WebXR implementation continues to progress. The main highlight is support for the WebXR Layers API: quad, cylinder, equirect, and cube layers are now implemented, in addition to the already supported projection layers. Layers can be backed by texture arrays, and XRSession.maxRenderLayers lets content query the compositor’s layer budget.

The backend has also been decoupled from OpenGL ES through an abstract graphics binding, paving the way for a future Vulkan-based binding.

WebXR support remains a build-time option, enabled with the ENABLE_WEBXR=ON CMake option; the Layers support additionally requires ENABLE_WEBXR_LAYERS=ON.

Other improvements to the WPE port

Several long-standing gaps in the WPE port have been closed this cycle:

A built-in popup menu is now used as the default implementation for <select> elements when the WebKitWebView::show-option-menu signal is left unhandled, so option menus work out of the box.
Initial drag-and-drop support has been added: web views now handle drags driven by the mouse events they already receive.
Spell checking is now supported using the Enchant library, enabled by default, and can be toggled at build time with the ENABLE_SPELLCHECKING CMake option.
The on-screen keyboard is no longer shown when an element is focused programmatically; it only appears as a result of user interaction.
Initial support for the Pointer Lock API can be enabled at build time with the ENABLE_POINTER_LOCK CMake option.
Saving files from the Web Inspector now works in WPE.

Web Platform support

As usual, this list is not exhaustive as WebKit continuously progresses in its support for new standards. Some of the highlights for this release are:

The Temporal API, a modern replacement for Date, is now enabled.
WebAssembly JavaScript Promise Integration (JSPI) is now enabled, along with the WebAssembly Multi-Memory and Relaxed SIMD proposals.
Customizable select elements (appearance: base-select) are now supported.
The CloseWatcher API and the closedby attribute for <dialog> are now enabled.
CSS scroll anchoring is now enabled.
The CSS @function rule and the if() function are now available.
Advanced attr() substitution is now available.
The Origin-Agent-Cluster header is now supported.
Transferable streams and ReadableStream.from() are now enabled.
IndexedDB getAllRecords() is now supported.
Time zone changes in the host system are now picked up at runtime by Date and Intl.

What’s new for WebKit developers?

WebKit can now use mimalloc as its memory allocator, as an alternative to its own bmalloc. For now it is the default only on some architectures (32-bit ARM, MIPS, RISC-V, and builds supporting 64 KB memory pages); everywhere else bmalloc remains the default, and mimalloc can be enabled with the USE_MIMALLOC build option.

Logging now falls back to the standard error output when journald is not reachable, which is common in minimal containers, and the new WEBKIT_DEBUG_OUTPUT environment variable allows choosing the log destination explicitly.

Profile-guided optimization is now supported in regular CMake builds with Clang, through the ENABLE_LLVM_PROFILE_GENERATION and USE_PGO_PROFILE options.

Finally, a note for packagers: building WPE WebKit now requires Ninja, as the CMake Makefile generator is no longer supported.

Looking forward to 2.56

The 2.56 release series will bring even more improvements, and we expect it to be released during the spring of 2027. Until then!

WPE WebKit 2.53.92 released

2026-09-03T00:00:00Z

This is a development release leading towards the 2.54 series.

What’s new in WPE WebKit 2.53.92?

Fix opacity animation not damaging descendant layers.
Fix expiration date of favicons in the icon database.
Fix webkit_web_view_get_tls_info() that sometimes returned FALSE for valid HTTPS connections.
Fix Ctrl-C failure to copy non-editable content to the clipboard.
Fix documentation of webkit_web_view_call_async_javascript_function().
Use a Chrome User-Agent for Prime Video.
Fix the build with USE_SPIEL=ON.
Fix several crashes and rendering issues.

Checksums

wpewebkit-2.53.92.tar.xz (44.2 MiB)
   md5sum: ddd0b23f1d3137227a9fec04c7f07ddd
   sha1sum: dfcfcab775b043a99e62f8cafc7af66f3b2d703f
   sha256sum: 173b1b0b0f39bcf138eb4334874e3dec4e0409cf90fcac75dc6cca893bd1c065

WPE WebKit 2.53.91 released

2026-08-21T00:00:00Z

This is a development release leading towards the 2.54 series.

What’s new in WPE WebKit 2.53.91?

Enable paint damage propagation by default.
Handle video orientation in the Skia compositor.
Do not use cached credentials when the Authorization header is present.
Fix scrollbar rendering issues due to incorrect damage tracking.
Add logging fallback to the standard error output when journald is not reachable.
Require Ninja for building. Using the CMake Makefile generator is no longer supported.
Fix the build with CMake 4.4 or newer.
Fix several crashes and rendering issues.

Checksums

wpewebkit-2.53.91.tar.xz (44.2 MiB)
   md5sum: 6951fbf5cd04360f6a954d3c520cc470
   sha1sum: 7726d367563dcfa90b4cbd566c8bef68410966d7
   sha256sum: 4053ae3386b7f9b1b3b6d4b6e05392a81ee29bbb716776a5a433d7a23bc8f8ec

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0005

2026-08-20T00:00:00Z

Date Reported: August 20, 2026
Advisory ID: WSA-2026-0005
CVE identifiers: CVE-2026-28984, CVE-2026-43804, CVE-2026-64713, CVE-2026-64719, CVE-2026-64728, CVE-2026-64730, CVE-2026-64757, CVE-2026-64783, CVE-2026-64787

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

CVE-2026-28984
- Versions affected: WebKitGTK and WPE WebKit before 2.52.4.
- Credit to Artem Dinaburg of Trail of Bits via Anthropic CVD.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: The issue was addressed with improved memory handling.
- WebKit Bugzilla: 311883
CVE-2026-43804
- Versions affected: WebKitGTK and WPE WebKit before 2.52.6.
- Credit to Heiko Kiesel of SEEMOO, TU Darmstadt.
- Impact: Visiting a website may lead to an app denial-of-service. Description: This issue was addressed through improved state management.
- WebKit Bugzilla: 316816
CVE-2026-64713
- Versions affected: WebKitGTK and WPE WebKit before 2.52.6.
- Credit to Kwak Kiyong, Song Nuri.
- Impact: Websites may know if the user has visited a given link. Description: This issue was addressed with improved checks.
- WebKit Bugzilla: 316827
CVE-2026-64719
- Versions affected: WebKitGTK and WPE WebKit before 2.52.6.
- Credit to Shaheen Fazim.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: An out-of-bounds access issue was addressed with improved bounds checking.
- WebKit Bugzilla: 319404
CVE-2026-64728
- Versions affected: WebKitGTK and WPE WebKit before 2.52.6.
- Credit to an anonymous researcher.
- Impact: Maliciously crafted web content may violate iframe sandboxing policy. Description: A permissions issue was addressed with improved validation.
- WebKit Bugzilla: 313220
CVE-2026-64730
- Versions affected: WebKitGTK and WPE WebKit before 2.52.6.
- Credit to Kagami Rosylight of Mozilla.
- Impact: Visiting a website that frames malicious content may lead to UI spoofing. Description: The issue was addressed with improved UI.
- WebKit Bugzilla: 311660
CVE-2026-64757
- Versions affected: WebKitGTK and WPE WebKit before 2.52.6.
- Credit to Milad Nasr and Nicholas Carlini with Claude, Anthropic.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A memory corruption issue was addressed with improved state management.
- WebKit Bugzilla: 315082
CVE-2026-64783
- Versions affected: WebKitGTK and WPE WebKit before 2.52.6.
- Credit to 杉山壮太, lattice, Behzad Najjarpour Jabbari (@G4ru), Junyeong Lee, Mooth.ai, OGINOME Tomohito, Using GLM From Z.AI, Gia Bui (@yabeow) from Calif.io.
- Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313521
CVE-2026-64787
- Versions affected: WebKitGTK and WPE WebKit before 2.52.5.
- Credit to 杉山壮太, Shubham Chaskar.
- Impact: Processing maliciously crafted web content may lead to an unexpected process termination. Description: A use-after-free issue was addressed with improved memory management.
- WebKit Bugzilla: 313703

Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html or wpewebkit.org/security.

WPE WebKit 2.52.6 released

2026-08-19T00:00:00Z

This is a bug fix release in the stable 2.52 series.

What’s new in WPE WebKit 2.52.6?

Improve memory usage in pages that use font variations.
Allow disabling font subpixel rendering through WPESettings, which is now the default setting and matches font the default rendering in most desktop environments.
The webkit://gpu page now respects the dark theme user preference.
Fix cross compilation due to failure to pick the correct gio-unix-2.0 headers in certain configurations.
Fix calculating data sizes of reported through WebKitWebsiteData.
Fix the build with USE_SYSTEM_UNIFDEF=OFF, which still checked for an installed unifdef command unconditionally.
Fix the build with CMake 4.4 or newer.
Fix several crashes and rendering issues.

Checksums

wpewebkit-2.52.6.tar.xz (62.5 MiB)
   md5sum: a5ab0470904d86e22680e7e89dd88035
   sha1sum: 92b315bda8ef52ec131bddceccdbc5465c804847
   sha256sum: b2bafef2751625b7fdf530f230ff0f542ff0eeba3590c3a989d931b2a55c858e

WPE WebKit 2.53.90 released

2026-08-08T00:00:00Z

This is a development release leading towards the 2.54 series.

What’s new in WPE WebKit 2.53.90?

Do not support rendering tiles in the main thread in accelerated compositing mode.
Add magnification property to WebKitWebView to handle visual scaling.
Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
Add WEBKIT_INPUT_PURPOSE_SEARCH to the API (and conversely WPE_INPUT_PURPOSE_SEARCH in WPEPlatform) which allows detecting when values of an input fields are expected to be search terms.
Improved platform media queries to handle prefers reduced motion, high contrast and dark theme.
Improved drag-and-drop support.
Allow disabling font subpixel rendering, which is now the default setting and matches font the default rendering in most desktop environments.
Add a feature flag to support skipping caching of pages with multimedia content in the back-forward cache.
Add a built-in popup menu support, used as the default implementation when the WebKitWebView::show-option-menu signal is left unhandled.
Add initial support for the Pointer Lock API, which may be enabled at build time with the ENABLE_POINTER_LOCK CMake option.
MiniBrowser now handles the SIGTERM and SIGINT signals, and exits cleanly.
Fix several crashes and rendering issues.

Checksums

wpewebkit-2.53.90.tar.xz (44.2 MiB)
   md5sum: fd36d5f8f0da47d1322b9f502a0201d4
   sha1sum: 95d1c454efbc1c7cd4472ff63d028001aa68f8ea
   sha256sum: a3900b3c0cb1848a192055fa4940f3500f0eca0680079f8aacabc34034a10c2e

WPEwebkit.org

WPE WebKit 2.54.1 released

What’s new in WPE WebKit 2.54.1?

Checksums

WPEPlatform: the new WPE API

How WPE used to integrate with the platform

What WPEPlatform changes

Using WPEPlatform in an application

Migrating from libwpe

Further reading

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006

WPE WebKit 2.54.0 released

Highlights of the WPE WebKit 2.54.0 release

Checksums

WPE WebKit 2.54 highlights

WPEPlatform: the new WPE API

Additions and final adjustments

Beyond Linux: Android

On the WebKit API side

Graphics improvements

A new Skia-based compositor

Damage-aware compositing

The performance impact

Other rendering improvements

Better multimedia on embedded hardware, and a WebRTC transition

WebXR

Other improvements to the WPE port

Web Platform support

What’s new for WebKit developers?

Looking forward to 2.56

WPE WebKit 2.53.92 released

What’s new in WPE WebKit 2.53.92?

Checksums

WPE WebKit 2.53.91 released

What’s new in WPE WebKit 2.53.91?

Checksums

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0005

WPE WebKit 2.52.6 released

What’s new in WPE WebKit 2.52.6?

Checksums

WPE WebKit 2.53.90 released

What’s new in WPE WebKit 2.53.90?

Checksums