Vulnerability Spotlight: Multiple vulnerabilities in Web Kit
Summary: Cisco Talos discovered multiple use-after-free vulnerabilities in the WebKit browser engine, including TALOS-2020-1155/CVE-2020-13543 in WebKitGTK 2.30.0's WebSocket functionality and TALOS-2020-1195/CVE-2020-13584 in WebKitGTK 2.30.1 x64's ImageDecoderGStreamer. An attacker can trigger remote arbitrary code execution by tricking a user into visiting a specially crafted malicious web page on a browser using WebKit, and Talos worked with WebKit to resolve the issues and release an update.
What's compelling: Exploitation requires only that a user open a crafted web page in a WebKit-based browser, so the attack surface extends to every user who browses the web on an affected version. Talos confirmed versions 2.30.0 and 2.30.1 are affected and published Snort rules 55844, 55845, 56126, 56127 and 56379-56382 to detect exploitation attempts.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-13543CVE-2020-13584
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026