WebKitGTK EUVD-2026-64858

Exploitation requires a user on an affected RHEL 6-9 system to actively process attacker-controlled web content using a WebKitGTK-based application (UI:R per CVSS vector). No authentication or special privileges are required from the attacker's perspective (PR:N per CVSS vector). Limiting factors: the victim must be socially engineered or otherwise induced to visit the malicious content; exploitation is constrained to hosts where WebKitGTK is installed and actively used by a logged-in user; the S:U scope means the flaw does not inherently break out of the browser process without a chained privilege escalation or sandbox escape exploit. Systems where WebKitGTK is installed as a dependency but no user-facing browser application is in active use have a substantially reduced practical attack surface.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high severity with low exploitation complexity, but the UI:R requirement is the primary gating factor - the attacker must induce a user to process malicious web content rather than achieving exploitation passively. EPSS data was not supplied, and neither a CISA KEV listing nor public POC code has been identified, so elevated urgency is driven by score and product footprint rather than confirmed active exploitation. The S:U (unchanged scope) designation indicates the vulnerability does not inherently escape the browser process boundary, though use-after-free primitives in browser engines are frequently chained with sandbox escape vulnerabilities to achieve full system compromise. The breadth of affected RHEL versions (6 through 9) means the attack surface spans both legacy and current production deployments; any organization running WebKitGTK-based desktop applications on RHEL should prioritize patching once Red Hat errata are released, as the user-interaction requirement does not provide strong defense-in-depth on its own.

An attacker registers a domain and hosts a page containing crafted HTML, JavaScript, or media content engineered to trigger the use-after-free condition in WebKitGTK's rendering engine. A user on an affected RHEL system opens the URL in GNOME Web or another WebKitGTK-based application; the engine frees a heap object during content processing but retains a stale pointer to it, which is then accessed, corrupting heap metadata. With suitable heap grooming the attacker redirects execution to shellcode or a ROP chain, achieving code execution in the browser process. No public exploit code has been identified at time of analysis, but the vulnerability class is well-documented in browser exploit literature.