WebKitGTK and WPE WebKit CVE-2025-66286

The vulnerability requires user interaction (UI:R in CVSS) to visit a webpage containing the malicious content. The attacker must craft HTTP requests of a specific type that the WebPage::send-request signal handler does not intercept; the exact request categories are not detailed in available references but are documented in WebKit bug tracker issue #259787. Applications that do not use the WebPage::send-request signal handler, or that do not rely on it for security-critical decisions, are not vulnerable. The vulnerability is present in default configurations of WebKitGTK and WPE WebKit; no special build flags or configuration enables the flaw-it exists by design. Limiting factors: (1) user must visit or interact with untrusted content, (2) the application must be using WebKitGTK/WPE WebKit (not other browsers like Firefox or Chromium), and (3) the application must rely on the send-request signal for access control.

The CVSS score of 4.7 reflects a medium-low severity with network attack vector (AV:N), low complexity (AC:L), no privilege requirements (PR:N), but mandatory user interaction (UI:R) and changed scope (S:C). The changed scope indicates the vulnerability can affect resources or security domains beyond the vulnerable component itself. Confidentiality impact is limited (C:L), with no integrity or availability impact, suggesting information disclosure rather than data modification or service disruption. The user interaction requirement significantly constrains real-world exploitation-an attacker must trigger the user to visit a malicious website. However, the 'changed scope' flag is noteworthy: it suggests that bypassed network requests could leak information about the user's network configuration, IP address, or DNS infrastructure to external systems. No active exploitation (KEV status unknown from provided data) or public exploit code (POC status unknown) is indicated, suggesting this is a design vulnerability that may be exploited opportunistically by attackers monitoring network traffic or running network enumeration against targeted users. The lack of code execution capability limits immediate damage, but the authorization bypass itself represents a fundamental trust boundary violation that applications and users cannot mitigate through configuration alone.

An attacker hosts a malicious website and tricks a user into visiting it (or embeds the attack in a legitimate site via XSS). The malicious content triggers an HTTP request type that is not caught by the application's WebPage::send-request signal handler. The bypassed request leaks the user's IP address, initiates a DNS lookup revealing internal network information, or performs a port scan via HTTP probes. The attacker collects this information without the application's knowledge or approval, gathering reconnaissance data for further attacks.