CVE-2026-28901

highcovered by 2 sourcesfirst seen 2026-07-23

The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2024-4367 Thomas Rinsma discovered that a type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. CVE-2026-28847 DARKNAVY, an anonymous researcher and Daniel Rhea discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2026-28883 Kwak Kiyong discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2026-28901 Joshua Rogers, Luigino Camastra, Igor Morgenstern, Guido Vranken, Maher Azzouzi and Ngan Nguyen discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2026-28902 Tristan Madani and Nathaniel Oh discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2026-28903 Mateusz Krzywicki discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2026-28904 Luka Racki discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2026-28905 Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2026-28907 Cantina discovered that processing maliciously crafted web content may prevent Content Security Policy from being enforced. CVE-2026-28942 Milad Nasr and Nicholas Carlini discovered that processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-28946 Gia Bui, dr3dd, and w0wbox discovered that processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-28947 dr3dd discovered that processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2026-28953 Maher Azzouzi discovered that processing maliciously crafted web content may lead to an unexpected process crash

CSIRTS triage

What: Multiple vulnerabilities have been discovered that may lead to unexpected process crashes or arbitrary JavaScript execution.
Who is affected: Users of WebKitGTK affected by the vulnerabilities.
Urgency: Remediation is important as these vulnerabilities could lead to severe impacts, although exploitation status is not confirmed.
Action: Users should apply the latest security updates provided by WebKitGTK.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-28901

Get an email if CVE-2026-28901 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.

Advisory coverage (2)

high[UPDATE] [high] WebKitGTK: Multiple vulnerabilitiescert-bund · 2026-07-24
unknownDSA-6398-1 webkit2gtk - security updatedebian · 2026-07-23

External references

NVD record for CVE-2026-28901

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-28901 status](https://www.csirts.com/badge/CVE-2026-28901)](https://www.csirts.com/cve/CVE-2026-28901)