CVEvulnerability
CVE-2025-66286
4.7 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-04-23
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
- Weaknesses
- CWE-639
Description
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the
WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://access.redhat.com/security/cve/CVE-2025-66286 access.redhat.com
- https://bugs.webkit.org/show_bug.cgi?id=259787 bugs.webkit.org
- https://bugzilla.redhat.com/show_bug.cgi?id=2424652 bugzilla.redhat.com