Week 34, 2026
21 WebKit CVEs disclosed in the week of August 17, 2026 (ISO week 34). 16 have a public fix commit; 5 embargoed.
| Severity | Count |
|---|---|
| Medium | 21 |
By component: JSC (12), WebKit (6), WebCore (3)
By bug class: TypeConfusion (7), LogicError (5), UAF (4), OOB (3), IntegerOverflow (2)
| CVE | Bugzilla | Component | Class | Severity | Fix |
|---|---|---|---|---|---|
| CVE-2026-65351 | 321517 | WebKit | LogicError | medium | embargoed |
| CVE-2026-65341 | 318405 | WebCore | IntegerOverflow | medium | commit |
| CVE-2026-65340 | 316996 | JSC | OOB | medium | commit |
| CVE-2026-65338 | 318348 | JSC | TypeConfusion | medium | commit |
| CVE-2026-65337 | 317142 | JSC | UAF | medium | commit |
| CVE-2026-65336 | 317349 | JSC | TypeConfusion | medium | commit |
| CVE-2026-65335 | 316723 | JSC | OOB | medium | commit |
| CVE-2026-65334 | 316791 | JSC | TypeConfusion | medium | commit |
| CVE-2026-65333 | 317603 | JSC | TypeConfusion | medium | commit |
| CVE-2026-65332 | 317450 | JSC | TypeConfusion | medium | commit |
| CVE-2026-65331 | 317611 | JSC | TypeConfusion | medium | commit |
| CVE-2026-64787 | 313703 | WebCore | UAF | medium | commit |
| CVE-2026-64784 | 317632 | JSC | IntegerOverflow | medium | commit |
| CVE-2026-64782 | 321480 | WebKit | LogicError | medium | embargoed |
| CVE-2026-64781 | 321484 | WebKit | LogicError | medium | embargoed |
| CVE-2026-64780 | 316918 | JSC | TypeConfusion | medium | commit |
| CVE-2026-64779 | 321485 | WebKit | LogicError | medium | embargoed |
| CVE-2026-64778 | 322124 | WebKit | LogicError | medium | embargoed |
| CVE-2026-64715 | 316347 | JSC | UAF | medium | commit |
| CVE-2026-43795 | 313452 | WebCore | OOB | medium | commit |
| CVE-2026-43794 | 317317 | WebKit | UAF | medium | commit |