Week 20, 2026
23 WebKit CVEs disclosed in the week of May 11, 2026 (ISO week 20). 21 have a public fix commit; 2 embargoed.
| Severity | Count |
|---|---|
| High | 2 |
| Medium | 21 |
By component: WebKit (8), JSC (8), WebCore (7)
By bug class: UAF (7), Bypass (4), TypeConfusion (3), OOB (3), LogicError (2), IntegerOverflow (1), Race (1), CrossOrigin (1), CSP Bypass (1)
| CVE | Bugzilla | Component | Class | Severity | Fix |
|---|---|---|---|---|---|
| CVE-2026-43670 | 309004 | WebKit | CSP Bypass | high | embargoed |
| CVE-2026-43660 | 308906 | WebCore | Bypass | medium | commit |
| CVE-2026-43658 | 307669 | JSC | UAF | medium | commit |
| CVE-2026-28984 | 311883 | JSC | TypeConfusion | medium | commit |
| CVE-2026-28971 | 311288 | WebKit | Bypass | medium | commit |
| CVE-2026-28962 | 309698 | WebKit | Bypass | medium | commit |
| CVE-2026-28958 | 311228 | WebCore | CrossOrigin | high | commit |
| CVE-2026-28955 | 310880 | WebCore | UAF | medium | commit |
| CVE-2026-28953 | 309628 | WebKit | LogicError | medium | commit |
| CVE-2026-28947 | 310234 | JSC | UAF | medium | commit |
| CVE-2026-28946 | 310544 | WebCore | UAF | medium | commit |
| CVE-2026-28944 | 311131 | WebCore | LogicError | medium | commit |
| CVE-2026-28942 | 312180 | WebCore | UAF | medium | commit |
| CVE-2026-28917 | 310527 | WebKit | OOB | medium | commit |
| CVE-2026-28913 | 311631 | WebKit | OOB | medium | commit |
| CVE-2026-28907 | 308675 | WebCore | Bypass | medium | commit |
| CVE-2026-28905 | 308545 | WebKit | TypeConfusion | medium | commit |
| CVE-2026-28904 | 309601 | JSC | IntegerOverflow | medium | commit |
| CVE-2026-28903 | 310303 | JSC | TypeConfusion | medium | commit |
| CVE-2026-28902 | 309861 | JSC | Race | medium | commit |
| CVE-2026-28901 | 310207 | JSC | UAF | medium | commit |
| CVE-2026-28883 | 313939 | WebKit | UAF | medium | embargoed |
| CVE-2026-28847 | 308707 | JSC | OOB | medium | commit |