DEBIAN-CVE-2026-86898

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-86898
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86898.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-86898
Upstream
  • CVE-2026-86898
Published
2026-09-14T21:17:40Z
Modified
2026-10-01T17:01:42Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.

References

Affected packages

Debian:12
webkit2gtk

Package

Name
webkit2gtk
Purl
pkg:deb/debian/webkit2gtk?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.40.1-1
2.40.2-1~deb11u1
2.40.2-1~deb12u1
2.40.2-1
2.40.3-1
2.40.3-2~deb11u1
2.40.3-2~deb11u2
2.40.3-2~deb12u1
2.40.3-2~deb12u2
2.40.3-2
2.40.4-1
2.40.5-1~deb11u1
2.40.5-1~deb12u1
2.40.5-1
2.41.4-1
2.41.5-1
2.41.6-1
2.41.90-1
2.41.91-1
2.41.91-2
2.41.92-1
2.42.0-1~bpo12+1
2.42.0-1
2.42.1-1~bpo12+1
2.42.1-1~deb11u1
2.42.1-1~deb11u2
2.42.1-1~deb12u1
2.42.1-1
2.42.1-2
2.42.2-1~deb11u1
2.42.2-1~deb12u1
2.42.2-1
2.42.3-1~deb11u1
2.42.3-1~deb12u1
2.42.3-1
2.42.4-1~deb11u1
2.42.4-1~deb12u1
2.42.4-1
2.42.5-1~deb11u1
2.42.5-1~deb12u1
2.42.5-1
2.42.5-2
2.43.1-1
2.43.2-1
2.43.3-1
2.43.4-1
2.43.4-2
2.44.0-1
2.44.0-2
2.44.1-1~deb11u1
2.44.1-1~deb12u1
2.44.1-1
2.44.2-1~deb11u1
2.44.2-1~deb12u1
2.44.2-1
2.44.3-1~deb11u1
2.44.3-1~deb12u1
2.44.3-1
2.44.4-1
2.45.1-1
2.45.1-2
2.45.2-1
2.45.3-1
2.45.4-1
2.45.5-1
2.45.6-1
2.45.91-1
2.45.92-1
2.46.0-1
2.46.0-2~deb12u1
2.46.0-2
2.46.1-1
2.46.1-2~bpo12+1
2.46.1-2
2.46.2-1
2.46.3-1~deb11u1
2.46.3-1~deb11u2
2.46.3-1~deb12u1
2.46.3-1
2.46.4-1~deb11u1
2.46.4-1~deb12u1
2.46.4-1
2.46.5-1~deb11u1
2.46.5-1~deb12u1
2.46.5-1
2.46.5-1+hurd.1
2.46.5-1+hurd.2
2.46.6-1~deb11u1
2.46.6-1~deb12u1
2.46.6-1
2.47.1-1
2.47.2-1
2.47.3-1
2.47.4-1
2.47.90-1
2.48.0-1~deb12u1
2.48.0-1
2.48.0-1+alpha
2.48.0-1+hurd.1
2.48.0-1+hurd.2
2.48.1-1
2.48.1-2~deb12u1
2.48.1-2
2.48.1-3
2.48.2-1
2.48.3-1~deb11u1
2.48.3-1~deb12u1
2.48.3-1
2.48.5-1~deb11u1
2.48.5-1~deb12u1
2.48.5-1~deb13u1
2.48.5-1
2.48.6-1
2.49.90-1
2.50.0-1
2.50.0-2
2.50.1-1~deb11u1
2.50.1-1~deb12u1
2.50.1-1~deb13u1
2.50.1-1
2.50.2-1~deb11u1
2.50.2-1~deb12u1
2.50.2-1~deb13u1
2.50.2-1
2.50.3-1~deb11u1
2.50.3-1~deb12u1
2.50.3-1~deb13u1
2.50.3-1
2.50.3-1+hurd.1
2.50.4-1~deb11u1
2.50.4-1~deb12u1
2.50.4-1~deb13u1
2.50.4-1
2.50.5-1
2.50.6-1~deb11u1
2.50.6-1~deb12u1
2.50.6-1~deb12u2
2.50.6-1~deb13u1
2.50.6-1
2.51.1-1
2.51.2-1
2.51.3-1
2.51.4-1
2.51.90-1
2.51.91-1
2.51.92-1
2.51.93-1
2.52.0-1
2.52.1-1
2.52.2-1
2.52.2-2
2.52.3-1
2.52.3-2~deb13u1
2.52.3-2
2.52.4-1
2.52.5-1~deb13u1
2.52.5-1
2.52.6-1~deb13u1
2.52.6-1
2.53.1-1
2.53.2-1
2.53.3-1
2.53.4-1
2.53.90-1
2.53.91-1
2.53.92-1
2.54.0-1~deb13u1
2.54.0-1~exp1

Ecosystem specific 

{
    "urgency":  "end-of-life"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86898.json"
wpewebkit

Package

Name
wpewebkit
Purl
pkg:deb/debian/wpewebkit?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.38.6-1
2.39.91-1
2.40.0-1
2.40.1-1
2.40.2-1
2.40.2-2
2.40.3-1
2.40.4-1
2.40.5-1
2.42.0-1
2.42.1-1
2.42.2-1
2.42.3-1
2.42.4-1
2.42.5-1
2.42.5-1.1~exp1
2.42.5-1.1
2.42.5-1.2
2.42.5-2~exp
2.44.1-1
2.44.2-1
2.44.2-2
2.44.3-1
2.44.4-1
2.46.1-1
2.46.2-1
2.46.3-1
2.46.4-1
2.46.5-1
2.46.6-1
2.48.0-1
2.48.1-1
2.48.1-2
2.48.2-1
2.48.3-1
2.48.5-1
2.48.6-1
2.48.6-2
2.50.0-1
2.50.0-2
2.50.1-1
2.50.2-1
2.50.3-1
2.50.4-1
2.50.5-1
2.50.6-1
2.52.0-1
2.52.1-1
2.52.2-1
2.52.2-2
2.52.3-1
2.52.4-1
2.52.5-1
2.52.6-1
2.54.0-1
2.54.0-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86898.json"
Debian:13
webkit2gtk

Package

Name
webkit2gtk
Purl
pkg:deb/debian/webkit2gtk?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.54.0-1~deb13u1

Affected versions

2.*
2.48.3-1
2.48.5-1~deb11u1
2.48.5-1~deb12u1
2.48.5-1~deb13u1
2.48.5-1
2.48.6-1
2.49.90-1
2.50.0-1
2.50.0-2
2.50.1-1~deb11u1
2.50.1-1~deb12u1
2.50.1-1~deb13u1
2.50.1-1
2.50.2-1~deb11u1
2.50.2-1~deb12u1
2.50.2-1~deb13u1
2.50.2-1
2.50.3-1~deb11u1
2.50.3-1~deb12u1
2.50.3-1~deb13u1
2.50.3-1
2.50.3-1+hurd.1
2.50.4-1~deb11u1
2.50.4-1~deb12u1
2.50.4-1~deb13u1
2.50.4-1
2.50.5-1
2.50.6-1~deb11u1
2.50.6-1~deb12u1
2.50.6-1~deb12u2
2.50.6-1~deb13u1
2.50.6-1
2.51.1-1
2.51.2-1
2.51.3-1
2.51.4-1
2.51.90-1
2.51.91-1
2.51.92-1
2.51.93-1
2.52.0-1
2.52.1-1
2.52.2-1
2.52.2-2
2.52.3-1
2.52.3-2~deb13u1
2.52.3-2
2.52.4-1
2.52.5-1~deb13u1
2.52.5-1
2.52.6-1~deb13u1
2.52.6-1
2.53.1-1
2.53.2-1
2.53.3-1
2.53.4-1
2.53.90-1
2.53.91-1
2.53.92-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86898.json"
wpewebkit

Package

Name
wpewebkit
Purl
pkg:deb/debian/wpewebkit?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.48.3-1
2.48.5-1
2.48.6-1
2.48.6-2
2.50.0-1
2.50.0-2
2.50.1-1
2.50.2-1
2.50.3-1
2.50.4-1
2.50.5-1
2.50.6-1
2.52.0-1
2.52.1-1
2.52.2-1
2.52.2-2
2.52.3-1
2.52.4-1
2.52.5-1
2.52.6-1
2.54.0-1
2.54.0-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86898.json"
Debian:14
webkit2gtk

Package

Name
webkit2gtk
Purl
pkg:deb/debian/webkit2gtk?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.48.3-1
2.48.5-1~deb11u1
2.48.5-1~deb12u1
2.48.5-1~deb13u1
2.48.5-1
2.48.6-1
2.49.90-1
2.50.0-1
2.50.0-2
2.50.1-1~deb11u1
2.50.1-1~deb12u1
2.50.1-1~deb13u1
2.50.1-1
2.50.2-1~deb11u1
2.50.2-1~deb12u1
2.50.2-1~deb13u1
2.50.2-1
2.50.3-1~deb11u1
2.50.3-1~deb12u1
2.50.3-1~deb13u1
2.50.3-1
2.50.3-1+hurd.1
2.50.4-1~deb11u1
2.50.4-1~deb12u1
2.50.4-1~deb13u1
2.50.4-1
2.50.5-1
2.50.6-1~deb11u1
2.50.6-1~deb12u1
2.50.6-1~deb12u2
2.50.6-1~deb13u1
2.50.6-1
2.51.1-1
2.51.2-1
2.51.3-1
2.51.4-1
2.51.90-1
2.51.91-1
2.51.92-1
2.51.93-1
2.52.0-1
2.52.1-1
2.52.2-1
2.52.2-2
2.52.3-1
2.52.3-2~deb13u1
2.52.3-2
2.52.4-1
2.52.5-1~deb13u1
2.52.5-1
2.52.6-1~deb13u1
2.52.6-1
2.53.1-1
2.53.2-1
2.53.3-1
2.53.4-1
2.53.90-1
2.53.91-1
2.53.92-1
2.54.0-1~deb13u1
2.54.0-1~exp1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86898.json"
wpewebkit

Package

Name
wpewebkit
Purl
pkg:deb/debian/wpewebkit?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.54.0-1

Affected versions

2.*
2.48.3-1
2.48.5-1
2.48.6-1
2.48.6-2
2.50.0-1
2.50.0-2
2.50.1-1
2.50.2-1
2.50.3-1
2.50.4-1
2.50.5-1
2.50.6-1
2.52.0-1
2.52.1-1
2.52.2-1
2.52.2-2
2.52.3-1
2.52.4-1
2.52.5-1
2.52.6-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-86898.json"