Week 27, 2026
31 WebKit CVEs disclosed in the week of June 29, 2026 (ISO week 27). 24 have a public fix commit; 7 embargoed.
| Severity | Count |
|---|---|
| Medium | 31 |
By component: WebKit (13), WebCore (12), JSC (6)
By bug class: UAF (13), OOB (4), Bypass (4), CrossOrigin (3), Race (2), LogicError (2), SandboxEscape (1), TypeConfusion (1), IntegerOverflow (1)
| CVE | Bugzilla | Component | Class | Severity | Fix |
|---|---|---|---|---|---|
| CVE-2026-43746 | 314090 | WebKit | UAF | medium | embargoed |
| CVE-2026-43745 | 315365 | JSC | LogicError | medium | commit |
| CVE-2026-43742 | 315161 | WebCore | UAF | medium | commit |
| CVE-2026-43740 | 308046 | JSC | OOB | medium | commit |
| CVE-2026-43735 | 313357 | WebCore | CrossOrigin | medium | commit |
| CVE-2026-43734 | 313693 | WebCore | UAF | medium | commit |
| CVE-2026-43732 | 313085 | WebKit | Bypass | medium | commit |
| CVE-2026-43731 | 314115 | WebKit | Race | medium | commit |
| CVE-2026-43727 | 313691 | WebCore | UAF | medium | commit |
| CVE-2026-43726 | 313857 | JSC | OOB | medium | commit |
| CVE-2026-43725 | 312832 | WebKit | SandboxEscape | medium | commit |
| CVE-2026-43721 | 313478 | WebCore | Bypass | medium | commit |
| CVE-2026-43720 | 313175 | WebCore | UAF | medium | commit |
| CVE-2026-43718 | 313350 | WebKit | IntegerOverflow | medium | embargoed |
| CVE-2026-43717 | 313351 | WebKit | UAF | medium | embargoed |
| CVE-2026-43716 | 313473 | JSC | UAF | medium | commit |
| CVE-2026-43715 | 313577 | WebCore | UAF | medium | commit |
| CVE-2026-43713 | 314806 | WebCore | Bypass | medium | commit |
| CVE-2026-43712 | 314235 | JSC | UAF | medium | commit |
| CVE-2026-43709 | 314398 | WebKit | UAF | medium | commit |
| CVE-2026-43708 | 315306 | WebKit | CrossOrigin | medium | commit |
| CVE-2026-43707 | 315951 | WebKit | LogicError | medium | embargoed |
| CVE-2026-43705 | 314528 | WebCore | TypeConfusion | medium | commit |
| CVE-2026-43704 | 314642 | WebKit | UAF | medium | commit |
| CVE-2026-43701 | 315004 | WebCore | Bypass | medium | commit |
| CVE-2026-43700 | 315368 | WebCore | CrossOrigin | medium | commit |
| CVE-2026-43699 | 317227 | WebKit | UAF | medium | embargoed |
| CVE-2026-43676 | 317231 | WebKit | OOB | medium | embargoed |
| CVE-2026-43663 | 312781 | JSC | UAF | medium | commit |
| CVE-2026-39872 | 313528 | WebCore | Race | medium | commit |
| CVE-2026-28979 | 317324 | WebKit | OOB | medium | embargoed |