WebKitGTK and WPE WebKit Security Advisory WSA-2025-0010

• Date Reported: December 17, 2025

• Advisory ID: WSA-2025-0010

• CVE identifiers: CVE-2025-14174, CVE-2025-43501, CVE-2025-43529, CVE-2025-43531, CVE-2025-43535, CVE-2025-43536, CVE-2025-43541

Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.

• CVE-2025-14174

  • Versions affected: WebKitGTK and WPE WebKit before 2.50.4.
  • Credit to Apple and Google Threat Analysis Group.
  • Impact: Processing maliciously crafted web content may lead to memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report. Description: A memory corruption issue was addressed with improved validation.
  • WebKit Bugzilla: 303614

• CVE-2025-43501

  • Versions affected: WebKitGTK and WPE WebKit before 2.50.4.
  • Credit to Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A buffer overflow issue was addressed with improved memory handling.
  • WebKit Bugzilla: 301371

• CVE-2025-43529

  • Versions affected: WebKitGTK and WPE WebKit before 2.50.4.
  • Credit to Google Threat Analysis Group.
  • Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report. Description: A use-after-free issue was addressed with improved memory management.
  • WebKit Bugzilla: 302502

• CVE-2025-43531

  • Versions affected: WebKitGTK and WPE WebKit before 2.50.4.
  • Credit to Phil Pizlo of Epic Games.
  • Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A race condition was addressed with improved state handling.
  • WebKit Bugzilla: 301940

• CVE-2025-43535

  • Versions affected: WebKitGTK and WPE WebKit before 2.50.4.
  • Credit to Google Big Sleep, Nan Wang (@eternalsakura13).
  • Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: The issue was addressed with improved memory handling.
  • WebKit Bugzilla: 301338

• CVE-2025-43536

  • Versions affected: WebKitGTK and WPE WebKit before 2.50.4.
  • Credit to Nan Wang (@eternalsakura13).
  • Impact: Processing maliciously crafted web content may lead to an unexpected process crash. Description: A use-after-free issue was addressed with improved memory management.
  • WebKit Bugzilla: 301726

• CVE-2025-43541

  • Versions affected: WebKitGTK and WPE WebKit before 2.50.4.
  • Credit to Hossein Lotfi (@hosselot) of Trend Micro Zero Day Initiative.
  • Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash. Description: A type confusion issue was addressed with improved state handling.
  • WebKit Bugzilla: 301257

We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.

Further information about WebKitGTK and WPE WebKit security advisories can be found at: webkitgtk.org/security.html or wpewebkit.org/security.