CVE-2025-30427

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash.

ajajfxhj discovered that processing web content may lead to a denial-of-service. Muhammad Zaid Ghifari and Kalimantan Utara discovered that loading a malicious iframe may lead to a cross-site scripting attack. Francisco Alonso and an anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected process crash. The Google V8 Security Team discovered that a type confusion issue could lead to memory corruption. Note that this CVE is fixed only on ARM architectures. x86_64 is not vulnerable, x86 is not vulnerable when the SSE2 instruction set is enabled; but other architectures remain vulnerable. Paul Bakker discovered that processing maliciously crafted web content may lead to an unexpected Safari crash. Gary Kwong and an anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected crash. rheza discovered that processing maliciously crafted web content may lead to an unexpected crash.