CVE-2023-23529
webkitgtk: processing maliciously crafted web content may be exploited for arbitrary code execution
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 13, 2023
Updated · November 21, 2025
Description
A vulnerability was found in WebKitGTK. This issue occurs when processing maliciously crafted web content in WebKit. This may, in theory, allow a remote attacker to create a specially crafted web page, trick the victim into opening it, trigger type confusion, and execute arbitrary code on the target system.
Statement
Red Hat is not aware of any exploitation of this flaw in Linux platforms at this time.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Setting the environment variable JSC_useDFGJIT=0 will mitigate this issue.
CVSS / CWE
CVSS 3.1 · 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer