Week 7, 2026
6 WebKit CVEs disclosed in the week of February 9, 2026 (ISO week 7). 4 have a public fix commit; 2 embargoed.
| Severity | Count |
|---|---|
| Medium | 6 |
By component: WebCore (2), JSC (2), WebKit (2)
By bug class: LogicError (3), IntegerOverflow (1), CrossOrigin (1), TypeConfusion (1)
| CVE | Bugzilla | Component | Class | Severity | Fix |
|---|---|---|---|---|---|
| CVE-2026-20676 | 305020 | WebCore | CrossOrigin | medium | commit |
| CVE-2026-20652 | 303959 | WebCore | IntegerOverflow | medium | commit |
| CVE-2026-20644 | 303444 | JSC | TypeConfusion | medium | commit |
| CVE-2026-20636 | 304657 | WebKit | LogicError | medium | embargoed |
| CVE-2026-20635 | 304661 | WebKit | LogicError | medium | embargoed |
| CVE-2026-20608 | 303357 | JSC | LogicError | medium | commit |