Week 13, 2026
7 WebKit CVEs disclosed in the week of March 23, 2026 (ISO week 13). 7 have a public fix commit; 0 embargoed.
| Severity | Count |
|---|---|
| Medium | 7 |
By component: WebCore (3), JSC (2), WebKit (2)
By bug class: LogicError (2), Bypass (1), UAF (1), Race (1), CrossOrigin (1), OOB (1)
| CVE | Bugzilla | Component | Class | Severity | Fix |
|---|---|---|---|---|---|
| CVE-2026-28871 | 305859 | WebCore | LogicError | medium | commit |
| CVE-2026-28861 | 307014 | WebCore | CrossOrigin | medium | commit |
| CVE-2026-28859 | 308248 | WebKit | OOB | medium | commit |
| CVE-2026-28857 | 307723 | JSC | Race | medium | commit |
| CVE-2026-20691 | 306827 | WebKit | LogicError | medium | commit |
| CVE-2026-20665 | 304951 | WebCore | Bypass | medium | commit |
| CVE-2026-20664 | 306136 | JSC | UAF | medium | commit |