CVE-2026-28861

webkitgtk: A malicious website may be able to access script message handlers intended for other origins

Loading…

Severity

Important

Red Hat Product Security

4.3

CVSS 3.1

Review impact separately from score.

Published · March 29, 2026

Updated · June 28, 2026

Description

A flaw was found in WebKitGTK. A maliciously crafted web page can cause a logic issue due to improper state management and may be able to access script message handlers intended for other origins.

Statement

To exploit this flaw, an attacker needs to trick a user into visiting a maliciously crafted web page. Due to this reason, this flaw has been rated with an important severity.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-346 · Origin Validation Error