Week 31, 2026
9 WebKit CVEs disclosed in the week of July 27, 2026 (ISO week 31). 8 have a public fix commit; 1 embargoed.
| Severity | Count |
|---|---|
| Medium | 9 |
By component: WebCore (5), WebKit (2), WTF (1), JSC (1)
By bug class: CrossOrigin (2), OOB (2), Bypass (2), LogicError (1), UAF (1), Race (1)
| CVE | Bugzilla | Component | Class | Severity | Fix |
|---|---|---|---|---|---|
| CVE-2026-64783 | 313521 | WebCore | UAF | medium | commit |
| CVE-2026-64757 | 315082 | JSC | OOB | medium | commit |
| CVE-2026-64730 | 311660 | WTF | LogicError | medium | commit |
| CVE-2026-64728 | 313220 | WebCore | CrossOrigin | medium | commit |
| CVE-2026-64719 | 319404 | WebKit | OOB | medium | embargoed |
| CVE-2026-64718 | 313935 | WebCore | Race | medium | commit |
| CVE-2026-64713 | 316827 | WebCore | CrossOrigin | medium | commit |
| CVE-2026-43821 | 314867 | WebKit | Bypass | medium | commit |
| CVE-2026-43804 | 316816 | WebCore | Bypass | medium | commit |