WebKit out-of-bounds read

Malformed web content can trigger an out-of-bounds read in an image-processing path.

Published 28 Aug 2026Updated 1 Sep 20266 sources
CVSS 6.5

What happened

An image-processing path can read beyond the expected object boundary when handling malformed web content.

Affected versions

WebKit: Vendor advisory Fixed: Latest OS update.

Why it matters

The affected engine is used across several system applications, broadening potential content exposure.

Detection & mitigation

  • Apply the latest operating-system and browser updates.
  • Prioritize managed mobile and desktop fleets.
  • Review the vendor advisory for platform-specific fixed versions.

Public PoC references

No public PoC reference has passed the current publication threshold.