CVE-2025-66286 Webkitgtk: authorization bypass through webpage::send-request signal handler
Untrusted web content bypasses network request approval handlers in WebKitGTK, allowing unauthorized IP connections and HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-66286?
CVE-2025-66286 is a medium-severity vulnerability in Red Hat Enterprise Linux 6, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.
Weakness: CWE-639
Which versions are affected by CVE-2025-66286?
How do I fix CVE-2025-66286?
No fix has been published for CVE-2025-66286 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-66286 being exploited?
There is no known exploitation of CVE-2025-66286 in the wild and no public exploit code.
Sources
Also known as GHSA-qx86-g93j-m25r, UBUNTU-CVE-2025-66286.