CVE-2026-28947
Publication date 21 August 2026
Last updated 25 August 2026
Ubuntu priority
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| webkitgtk | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic | Ignored | |
| 16.04 LTS xenial | Ignored | |
| webkit2gtk | 26.04 LTS resolute |
Vulnerable
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Ignored | |
| 18.04 LTS bionic | Ignored | |
| 16.04 LTS xenial | Ignored | |
| qtwebkit-source | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic | Ignored | |
| 16.04 LTS xenial | Ignored | |
| qtwebkit-opensource-src | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Ignored | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Ignored | |
| 18.04 LTS bionic | Ignored | |
| 16.04 LTS xenial | Ignored | |
| wpewebkit | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Ignored |
Notes
jdstrand
webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8
mdeslaur
It is no longer possible to build new webkit2gtk versions on jammy and earlier. Marking as ignored. wpewebkit isn't used by anything of importance in the archive, except for cog, an example container for wpewebkit. There is no point in attempting to backport newer wpewebkit versions to the archive. As such, marking as ignored. It is not feasible to fix webkitgtk, qtwebkit-source, and qtwebkit-opensource-src. Marking them as ignored.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.8 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H