PatchGap · Vendor
WebKit
All tracked WebKit CVEs, mapped to their fixing commits with root-cause analysis and the patch gap.
Tracked
213
Commit mapped
184
Embargoed
29
Critical
9
High
6
Exploited ITW
0
CVEs 213
| CVE | Component | Class | Severity | ITW | Release | Fix | RCA |
|---|---|---|---|---|---|---|---|
| CVE-2026-43794 | WebKit | UAF | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-43795 | WebCore | OOB | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-64715 | JSC | UAF | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-64778 | WebKit | Logic Error | Medium | — | 2026-08-17 | — | ✓ |
| CVE-2026-64779 | WebKit | Logic Error | Medium | — | 2026-08-17 | — | ✓ |
| CVE-2026-64780 | JSC | Type Confusion | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-64781 | WebKit | Logic Error | Medium | — | 2026-08-17 | — | ✓ |
| CVE-2026-64782 | WebKit | Logic Error | Medium | — | 2026-08-17 | — | ✓ |
| CVE-2026-64784 | JSC | Integer Overflow | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-64787 | WebCore | UAF | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65331 | JSC | Type Confusion | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65332 | JSC | Type Confusion | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65333 | JSC | Type Confusion | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65334 | JSC | Type Confusion | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65335 | JSC | OOB | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65336 | JSC | Type Confusion | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65337 | JSC | UAF | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65338 | JSC | Type Confusion | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65340 | JSC | OOB | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65341 | WebCore | Integer Overflow | Medium | — | 2026-08-17 | ● | ✓ |
| CVE-2026-65351 | WebKit | Logic Error | Medium | — | 2026-08-17 | — | ✓ |
| CVE-2026-43804 | WebCore | Bypass | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-43821 | WebKit | Bypass | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-64713 | WebCore | Cross Origin | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-64718 | WebCore | Race | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-64719 | WebKit | OOB | Medium | — | 2026-07-27 | — | ✓ |
| CVE-2026-64728 | WebCore | Cross Origin | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-64730 | WTF | Logic Error | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-64757 | JSC | OOB | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-64783 | WebCore | UAF | Medium | — | 2026-07-27 | ● | ✓ |
| CVE-2026-28979 | WebKit | OOB | Medium | — | 2026-06-29 | — | ✓ |
| CVE-2026-39872 | WebCore | Race | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43663 | JSC | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43676 | WebKit | OOB | Medium | — | 2026-06-29 | — | ✓ |
| CVE-2026-43699 | WebKit | UAF | Medium | — | 2026-06-29 | — | ✓ |
| CVE-2026-43700 | WebCore | Cross Origin | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43701 | WebCore | Bypass | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43704 | WebKit | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43705 | WebCore | Type Confusion | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43707 | WebKit | Logic Error | Medium | — | 2026-06-29 | — | ✓ |
| CVE-2026-43708 | WebKit | Cross Origin | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43709 | WebKit | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43712 | JSC | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43713 | WebCore | Bypass | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43715 | WebCore | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43716 | JSC | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43717 | WebKit | UAF | Medium | — | 2026-06-29 | — | ✓ |
| CVE-2026-43718 | WebKit | Integer Overflow | Medium | — | 2026-06-29 | — | ✓ |
| CVE-2026-43720 | WebCore | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43721 | WebCore | Bypass | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43725 | WebKit | Sandbox Escape | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43726 | JSC | OOB | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43727 | WebCore | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43731 | WebKit | Race | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43732 | WebKit | Bypass | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43734 | WebCore | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43735 | WebCore | Cross Origin | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43740 | JSC | OOB | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43742 | WebCore | UAF | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43745 | JSC | Logic Error | Medium | — | 2026-06-29 | ● | ✓ |
| CVE-2026-43746 | WebKit | UAF | Medium | — | 2026-06-29 | — | ✓ |
| CVE-2026-28847 | JSC | OOB | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28883 | WebKit | UAF | Medium | — | 2026-05-11 | — | ✓ |
| CVE-2026-28901 | JSC | UAF | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28902 | JSC | Race | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28903 | JSC | Type Confusion | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28904 | JSC | Integer Overflow | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28905 | WebKit | Type Confusion | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28907 | WebCore | Bypass | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28913 | WebKit | OOB | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28917 | WebKit | OOB | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28942 | WebCore | UAF | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28944 | WebCore | Logic Error | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28946 | WebCore | UAF | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28947 | JSC | UAF | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28953 | WebKit | Logic Error | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28955 | WebCore | UAF | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28958 | WebCore | Cross Origin | High | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28962 | WebKit | Bypass | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28971 | WebKit | Bypass | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-28984 | JSC | Type Confusion | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-43658 | JSC | UAF | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-43660 | WebCore | Bypass | Medium | — | 2026-05-11 | ● | ✓ |
| CVE-2026-43670 | WebKit | CSP Bypass | High | — | 2026-05-11 | — | ✓ |
| CVE-2026-20664 | JSC | UAF | Medium | — | 2026-03-24 | ● | ✓ |
| CVE-2026-20665 | WebCore | Bypass | Medium | — | 2026-03-24 | ● | ✓ |
| CVE-2026-20691 | WebKit | Logic Error | Medium | — | 2026-03-24 | ● | ✓ |
| CVE-2026-28857 | JSC | Race | Medium | — | 2026-03-24 | ● | ✓ |
| CVE-2026-28859 | WebKit | OOB | Medium | — | 2026-03-24 | ● | ✓ |
| CVE-2026-28861 | WebCore | Cross Origin | Medium | — | 2026-03-24 | ● | ✓ |
| CVE-2026-28871 | WebCore | Logic Error | Medium | — | 2026-03-24 | ● | ✓ |
| CVE-2026-20643 | WebCore | Cross Origin | High | — | 2026-03-17 | ● | ✓ |
| CVE-2026-20608 | JSC | Logic Error | Medium | — | 2026-02-11 | ● | ✓ |
| CVE-2026-20635 | WebKit | Logic Error | Medium | — | 2026-02-11 | — | ✓ |
| CVE-2026-20636 | WebKit | Logic Error | Medium | — | 2026-02-11 | — | ✓ |
| CVE-2026-20644 | JSC | Type Confusion | Medium | — | 2026-02-11 | ● | ✓ |
| CVE-2026-20652 | WebCore | Integer Overflow | Medium | — | 2026-02-11 | ● | ✓ |
| CVE-2026-20676 | WebCore | Cross Origin | Medium | — | 2026-02-11 | ● | ✓ |
| CVE-2025-14174 | WebKit | Logic Error | Medium | — | 2025-12-12 | — | ✓ |
| CVE-2025-43501 | WTF | Integer Overflow | Medium | — | 2025-12-12 | ● | ✓ |
| CVE-2025-43529 | JSC | UAF | Critical | — | 2025-12-12 | ● | ✓ |
| CVE-2025-43531 | bmalloc | Race | Medium | — | 2025-12-12 | ● | ✓ |
| CVE-2025-43535 | JSC | Type Confusion | Medium | — | 2025-12-12 | ● | ✓ |
| CVE-2025-43536 | JSC | UAF | Medium | — | 2025-12-12 | ● | ✓ |
| CVE-2025-43541 | JSC | Type Confusion | Medium | — | 2025-12-12 | ● | ✓ |
| CVE-2025-46282 | WebKit | Bypass | High | — | 2025-12-12 | ● | ✓ |
| CVE-2025-46298 | JSC | Type Confusion | Medium | — | 2025-12-12 | ● | ✓ |
| CVE-2025-46299 | WebKit | Logic Error | Medium | — | 2025-12-12 | — | ✓ |
| CVE-2025-43511 | WebCore | UAF | Medium | — | 2025-11-05 | ● | ✓ |
| CVE-2025-43392 | WebCore | Cross Origin | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43421 | JSC | OOB | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43425 | JSC | Logic Error | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43427 | JSC | OOB | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43429 | JSC | Integer Overflow | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43430 | JSC | Logic Error | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43431 | JSC | UAF | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43432 | JSC | UAF | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43433 | WebKit | Logic Error | Medium | — | 2025-11-03 | — | ✓ |
| CVE-2025-43434 | JSC | UAF | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43435 | WebCore | UAF | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43438 | JSC | Type Confusion | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43440 | JSC | Logic Error | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43441 | JSC | Logic Error | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43443 | WebKit | Logic Error | Medium | — | 2025-11-03 | — | ✓ |
| CVE-2025-43457 | JSC | UAF | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43458 | WebKit | Logic Error | Medium | — | 2025-11-03 | — | ✓ |
| CVE-2025-43480 | WebCore | Cross Origin | Medium | — | 2025-11-03 | ● | ✓ |
| CVE-2025-43272 | WebCore | OOB | Medium | — | 2025-09-15 | ● | ✓ |
| CVE-2025-43342 | JSC | Type Confusion | Medium | — | 2025-09-15 | ● | ✓ |
| CVE-2025-43343 | JSC | Type Confusion | Medium | — | 2025-09-15 | ● | ✓ |
| CVE-2025-43356 | WebKit | Logic Error | Medium | — | 2025-09-15 | ● | ✓ |
| CVE-2025-43368 | WebKit | UAF | Medium | — | 2025-09-15 | ● | ✓ |
| CVE-2025-43376 | WebCore | Logic Error | Medium | — | 2025-09-15 | ● | ✓ |
| CVE-2025-43419 | WebKit | Other | Medium | — | 2025-09-15 | ● | ✓ |
| CVE-2025-31273 | JSC | OOB | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-31277 | JSC | Type Confusion | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-31278 | JSC | Type Confusion | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43211 | JSC | Logic Error | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43212 | JSC | Logic Error | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43213 | JSC | Logic Error | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43214 | JSC | Integer Overflow | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43216 | WebCore | UAF | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43227 | WTF | Bypass | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43228 | WebKit | Bypass | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43229 | WebKit | Cross Origin | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43240 | WebKit | Cross Origin | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-43265 | JSC | OOB | Medium | — | 2025-07-29 | ● | ✓ |
| CVE-2025-24213 | WebCore | Type Confusion | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-24223 | WebKit | Logic Error | Medium | — | 2025-05-12 | — | ✓ |
| CVE-2025-31204 | JSC | OOB | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-31205 | WebCore | Cross Origin | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-31206 | JSC | Type Confusion | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-31215 | JSC | Type Confusion | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-31217 | WebKit | OOB | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-31223 | JSC | Integer Overflow | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-31238 | WebCore | UAF | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-31257 | WebCore | UAF | Medium | — | 2025-05-12 | ● | ✓ |
| CVE-2025-24208 | WebKit | Cross Origin | Medium | — | 2025-03-31 | ● | ✓ |
| CVE-2025-24209 | WebCore | OOB | Medium | — | 2025-03-31 | ● | ✓ |
| CVE-2025-24216 | WebCore | UAF | Medium | — | 2025-03-31 | ● | ✓ |
| CVE-2025-24264 | WebKit | Logic Error | Medium | — | 2025-03-31 | ● | ✓ |
| CVE-2025-30425 | WebCore | Logic Error | Medium | — | 2025-03-31 | ● | ✓ |
| CVE-2025-30427 | JSC | UAF | Medium | — | 2025-03-31 | ● | ✓ |
| CVE-2025-24201 | WebKit | OOB | Medium | — | 2025-03-11 | ● | ✓ |
| CVE-2025-24143 | WebKit | Logic Error | Medium | — | 2025-01-27 | ● | ✓ |
| CVE-2025-24150 | WebKit | Logic Error | Medium | — | 2025-01-27 | ● | ✓ |
| CVE-2025-24158 | WebKit | Logic Error | Medium | — | 2025-01-27 | ● | ✓ |
| CVE-2025-24162 | WebKit | Logic Error | Medium | — | 2025-01-27 | ● | ✓ |
| CVE-2025-24189 | WebKit | OOB | Medium | — | 2025-01-27 | ● | ✓ |
| CVE-2024-54479 | WebKit | Type Confusion | Medium | — | 2024-12-11 | ● | ✓ |
| CVE-2024-54502 | WebKit | UAF | Medium | — | 2024-12-11 | ● | ✓ |
| CVE-2024-54505 | JSC | Type Confusion | Medium | — | 2024-12-11 | ● | ✓ |
| CVE-2024-54508 | WebKit | Type Confusion | Medium | — | 2024-12-11 | ● | ✓ |
| CVE-2024-54534 | WebKit | UAF | Medium | — | 2024-12-11 | ● | ✓ |
| CVE-2024-54543 | WebKit | OOB | Medium | — | 2024-12-11 | ● | ✓ |
| CVE-2024-44308 | WebKit | OOB | Critical | — | 2024-11-19 | ● | ✓ |
| CVE-2024-44309 | WebKit | Cross Origin | Medium | — | 2024-11-19 | ● | ✓ |
| CVE-2024-44212 | WebKit | Cross Origin | Medium | — | 2024-10-28 | ● | ✓ |
| CVE-2024-44244 | WebKit | OOB | Medium | — | 2024-10-28 | ● | ✓ |
| CVE-2024-44296 | WebKit | Bypass | Medium | — | 2024-10-28 | ● | ✓ |
| CVE-2024-40857 | WebKit | Cross Origin | Medium | — | 2024-09-16 | ● | ✓ |
| CVE-2024-40866 | WebKit | Logic Error | Medium | — | 2024-09-16 | — | ✓ |
| CVE-2024-44187 | WebKit | Cross Origin | Medium | — | 2024-09-16 | — | ✓ |
| CVE-2024-44192 | WebKit | Logic Error | Medium | — | 2024-09-16 | ● | ✓ |
| CVE-2024-54467 | WebKit | Cross Origin | Medium | — | 2024-09-16 | — | ✓ |
| CVE-2024-40776 | WebKit | UAF | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-40779 | WebKit | OOB | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-40780 | WebKit | OOB | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-40782 | WebKit | Logic Error | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-40785 | WebKit | Bypass | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-40789 | WebKit | OOB | Medium | — | 2024-07-29 | — | ✓ |
| CVE-2024-40794 | WebKit | Logic Error | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-44185 | WebKit | Type Confusion | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-44206 | WebKit | Logic Error | High | — | 2024-07-29 | — | — |
| CVE-2024-4558 | WebKit | OOB | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-54551 | WebCore | UAF | Medium | — | 2024-07-29 | ● | ✓ |
| CVE-2024-27808 | JSC | UAF | Critical | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27820 | JSC | OOB | Critical | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27830 | WebCore | Logic Error | Medium | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27833 | JSC | Integer Overflow | Critical | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27834 | JSC | Bypass | High | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27838 | WebCore | Logic Error | Medium | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27850 | WebCore | Logic Error | Medium | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27851 | WebCore | OOB | Critical | — | 2024-05-13 | ● | ✓ |
| CVE-2024-27856 | WebCore | UAF | Critical | — | 2024-05-13 | ● | ✓ |
| CVE-2024-23263 | WebCore | Bypass | Medium | — | 2024-03-05 | ● | ✓ |
| CVE-2024-23280 | WebCore | Logic Error | Medium | — | 2024-03-05 | ● | ✓ |
| CVE-2024-23284 | WebCore | Bypass | Medium | — | 2024-03-05 | ● | ✓ |
| CVE-2024-54658 | WebCore | Logic Error | Medium | — | 2024-03-05 | — | ✓ |
| CVE-2024-23206 | WebKit | Bypass | Medium | — | 2024-01-22 | ● | ✓ |
| CVE-2024-23213 | WebCore | UAF | Critical | — | 2024-01-22 | ● | ✓ |
| CVE-2024-23222 | JSC | Type Confusion | Critical | — | 2024-01-22 | ● | ✓ |
| CVE-2024-23271 | WebCore | Bypass | Medium | — | 2024-01-22 | ● | ✓ |