CVE-2025-66286: Webkitgtk: authorization bypass through webpage::send-request signal handler
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66286?
CVE-2025-66286 is classified as a high-severity vulnerability due to its potential to allow unauthorized network requests.
How do I fix CVE-2025-66286?
To address CVE-2025-66286, update to the latest version of WebKitGTK or WPE WebKit that includes patches for this vulnerability.
Which applications are affected by CVE-2025-66286?
CVE-2025-66286 affects applications using WebKitGTK and WPE WebKit for web content rendering.
What kind of attack can be executed through CVE-2025-66286?
An attacker can exploit CVE-2025-66286 to perform unexpected IP connections, DNS lookups, and HTTP requests without proper authorization.
Is user interaction required to exploit CVE-2025-66286?
Yes, user interaction is typically required since the exploitation involves untrusted web content being loaded into a vulnerable application.