Lifecycle Timeline
3DescriptionCVE.org
Alpine Linux: qt6-qtwebengine fixed in 6.10.1-r2
AnalysisAI
Confirmed actively exploited vulnerability in qt6-qtwebengine on Alpine Linux has been patched in package version 6.10.1-r2. Qt6 WebEngine is a Chromium-based web content rendering component embedded in Qt6 applications; vulnerabilities in this component typically affect any application that renders untrusted web content. Despite CISA KEV confirmation of active exploitation, the EPSS score of 0.30% (53rd percentile) suggests exploitation has been targeted rather than widespread, warranting urgent patching prioritization nonetheless.
Technical ContextAI
Qt6 WebEngine (qt6-qtwebengine) is the Qt6 binding to the Chromium rendering engine, providing web content rendering capabilities to native Qt6 applications on Linux, macOS, and Windows. On Alpine Linux, it is packaged under the apk package manager. The specific CWE root cause class is not available in the provided data - no CWE identifier was assigned or disclosed. The vulnerability was disclosed by Alpine Linux (vendor:alpine) and addressed in the Alpine package revision 6.10.1-r2, which corresponds to Qt upstream version 6.10.1. Because the underlying engine is Chromium-derived, historically common vulnerability classes in this component include memory corruption (use-after-free, heap overflow), sandbox escapes, and type confusion in JavaScript engine or media parsing code - however, the specific class for this CVE is unconfirmed.
Affected ProductsAI
Alpine Linux systems running qt6-qtwebengine prior to version 6.10.1-r2 are affected. The fix is delivered via the Alpine Linux apk package manager, and the patched package version is qt6-qtwebengine-6.10.1-r2. No CPE strings were provided in the source data, and no other operating system distributions or upstream Qt versions are explicitly listed in the available intelligence, though downstream distributions packaging qt6-qtwebengine from the same upstream Qt 6.10.1 source may also be affected depending on whether they have applied the relevant upstream fix.
RemediationAI
The primary fix is to upgrade the qt6-qtwebengine package to version 6.10.1-r2 or later on Alpine Linux via 'apk upgrade qt6-qtwebengine'. This is a vendor-confirmed patch per the Alpine Linux advisory. Given the CISA KEV listing, this upgrade should be treated as emergency priority. No workarounds or compensating controls are specified in the available data. If patching is not immediately possible, a practical interim control would be to restrict or disable Qt6 applications in your environment that render untrusted web content (e.g., electron-like apps, embedded browser panels), as this would remove the attack surface while patch deployment is coordinated. No vendor advisory URL beyond the Alpine Linux package tracker was included in the provided references.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today