Week 50, 2025
10 WebKit CVEs disclosed in the week of December 8, 2025 (ISO week 50). 8 have a public fix commit; 2 embargoed.
| Severity | Count |
|---|---|
| Critical | 1 |
| High | 1 |
| Medium | 8 |
By component: JSC (5), WebKit (3), WTF (1), bmalloc (1)
By bug class: TypeConfusion (3), UAF (2), LogicError (2), Bypass (1), IntegerOverflow (1), Race (1)
| CVE | Bugzilla | Component | Class | Severity | Fix |
|---|---|---|---|---|---|
| CVE-2025-46299 | 299518 | WebKit | LogicError | medium | embargoed |
| CVE-2025-46298 | 301468 | JSC | TypeConfusion | medium | commit |
| CVE-2025-46282 | 295941 | WebKit | Bypass | high | commit |
| CVE-2025-43541 | 301257 | JSC | TypeConfusion | medium | commit |
| CVE-2025-43536 | 301726 | JSC | UAF | medium | commit |
| CVE-2025-43535 | 300774 | JSC | TypeConfusion | medium | commit |
| CVE-2025-43531 | 301940 | bmalloc | Race | medium | commit |
| CVE-2025-43529 | 302502 | JSC | UAF | critical | commit |
| CVE-2025-43501 | 301371 | WTF | IntegerOverflow | medium | commit |
| CVE-2025-14174 | 303614 | WebKit | LogicError | medium | embargoed |