Lifecycle Timeline
3DescriptionCVE.org
Alpine Linux: qt6-qtwebengine fixed in 6.9.1-r3
AnalysisAI
Active exploitation confirmed by CISA KEV affects qt6-qtwebengine on Alpine Linux, with the vulnerability addressed in package version 6.9.1-r3. The specific vulnerability class and technical mechanism are not disclosed in available intelligence - the only confirmed data point beyond KEV status is the Alpine Linux package fix designation. Despite CISA KEV confirmation, the EPSS score of 0.25% (49th percentile) is notably low, indicating exploitation is targeted rather than widespread or automated. Any application or system running Alpine Linux with qt6-qtwebengine prior to 6.9.1-r3 should be treated as at risk given the confirmed exploitation status.
Technical ContextAI
Qt WebEngine (qt6-qtwebengine) is the Qt 6 framework's web rendering component, built on top of the Chromium browser engine. It is used by Qt-based desktop and embedded applications to display web content, execute JavaScript, and handle web protocols. Because it embeds Chromium, its vulnerability surface typically includes the V8 JavaScript engine, HTML/CSS parser, media handling subsystems, and inter-process communication between the browser and renderer processes. The affected package is distributed via Alpine Linux's package manager (apk), and the fix is specific to Alpine's packaging of qt6-qtwebengine at version 6.9.1-r3. No CWE identifier is available to characterize the root cause class, and no CPE string was provided beyond what can be inferred from the Alpine package designation.
Affected ProductsAI
Alpine Linux systems running qt6-qtwebengine prior to version 6.9.1-r3 are confirmed affected based on the Alpine Linux vendor advisory. The fix is specific to Alpine's package ecosystem. No upstream Qt version range is explicitly confirmed in available data, though qt6-qtwebengine 6.9.1-r3 corresponds to the Alpine packaging of Qt 6.9.x series. No CPE string was provided. Other Linux distributions packaging qt6-qtwebengine independently (e.g., Arch Linux, Debian, Fedora) should be assessed separately against their own advisory channels, as this CVE is reported by the Alpine vendor and may reflect an Alpine-specific patch or backport.
RemediationAI
The primary remediation is to upgrade the Alpine Linux qt6-qtwebengine package to version 6.9.1-r3 or later using the Alpine package manager (apk upgrade qt6-qtwebengine). Given CISA KEV status, this upgrade should be treated as an emergency patch and applied without waiting for standard patch cycles. No workarounds are confirmed from available data; because the technical nature of the vulnerability is undisclosed, generic compensating controls cannot be responsibly recommended without risking false assurance. If immediate patching is not possible, consider disabling or isolating applications that depend on qt6-qtwebengine, particularly those that load untrusted or external web content. Organizations should also check the Alpine Linux security advisories at security.alpinelinux.org for additional guidance as technical details may be published post-disclosure.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today