qt6-qtwebengine CVE-2025-7656

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:34 vuln.today

DescriptionCVE.org

Alpine Linux: qt6-qtwebengine fixed in 6.9.1-r3

AnalysisAI

qt6-qtwebengine in Alpine Linux has been patched in package version 6.9.1-r3, addressing an unspecified vulnerability in the Qt6 WebEngine component. The underlying vulnerability type, attack vector, and impact are not disclosed in the available intelligence - only the Alpine Linux vendor advisory confirming a fix is present. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.25% (48th percentile), indicating below-average exploitation likelihood among all CVEs.

Technical ContextAI

qt6-qtwebengine is the Qt6 binding for the Chromium-based web rendering engine, used by Qt applications to embed web content. As a Chromium-derived component, it may inherit upstream Chromium vulnerabilities in areas such as JavaScript engine (V8), media handling, IPC, or sandbox escape paths. However, the specific CWE, vulnerability class, and root cause are entirely undisclosed in the available data. No CPE strings or CVSS vector were provided, preventing identification of the precise affected version range beyond the Alpine Linux package fix at 6.9.1-r3. The fix was reported solely by the Alpine Linux vendor.

Affected ProductsAI

The affected product is Alpine Linux's packaging of qt6-qtwebengine. The fix was introduced at Alpine package version 6.9.1-r3, implying all prior Alpine Linux package versions of qt6-qtwebengine before 6.9.1-r3 are potentially affected. No upstream Qt version range, CPE identifiers, or other Linux distribution advisories were provided in the available intelligence. The exact Alpine Linux release branches carrying the vulnerable package are not specified in the data.

RemediationAI

Update the Alpine Linux qt6-qtwebengine package to version 6.9.1-r3 or later using the standard Alpine package manager: 'apk upgrade qt6-qtwebengine'. This is the only confirmed fix identified from the available data, as reported by the Alpine Linux vendor. No upstream Qt advisory URL, CVE-specific vendor advisory link, or workaround information was included in the intelligence. If upgrading is not immediately possible, consider restricting application access to untrusted web content rendered via QtWebEngine as a compensating control, though the trade-off is reduced application functionality. No patch is documented for other distributions at time of analysis.