彙總 webkit 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
已披露問題常與 跨站腳本、緩衝區溢位與輸入驗證問題 相關，可能在 生產負載與軟體部署 場景中帶來 應用程式崩潰與異常行為 等暴露風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2020-9952 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack. | [email protected] | 7.1 | 1.48% | 2020-10-16 | 2024-11-21 |
| CVE-2020-9951 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution. | [email protected] | 8.8 | 2.25% | 2020-10-16 | 2024-11-21 |
| CVE-2020-9948 | A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution. | [email protected] | 8.8 | 1.64% | 2020-10-16 | 2024-11-21 |
| CVE-2018-4209 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks. | [email protected] | 8.8 | 2.06% | 2019-01-11 | 2024-11-21 |
| CVE-2018-12294 | WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object. | [email protected] | 8.8 | 2.46% | 2018-06-19 | 2024-11-21 |
| CVE-2016-9643 | The regex code in Webkit 2.4.11 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis). | [email protected] | 7.5 | 3.07% | 2017-03-07 | 2026-05-13 |
| CVE-2016-9642 | JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file. | [email protected] | 5.5 | 1.27% | 2017-02-03 | 2026-05-13 |
| CVE-2010-1766 | Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products, allows remote websockets servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an upgrade header that is long and invalid. | [email protected] | 7.5 | 2.35% | 2010-07-22 | 2026-04-29 |
| CVE-2009-3933 | WebKit before r50173, as used in Google Chrome before 3.0.195.32, allows remote attackers to cause a denial of service (CPU consumption) via a web page that calls the JavaScript setInterval method, which triggers an incompatibility between the WTF::currentTime and base::Time functions. | [email protected] | 5.0 | 3.10% | 2009-11-12 | 2026-04-23 |
| CVE-2008-6059 | xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism. | [email protected] | 5.0 | 1.95% | 2009-02-05 | 2026-04-23 |
| CVE-2008-1590 | JavaScriptCore in WebKit on Apple iPhone before 2.0 and iPod touch before 2.0 does not properly perform runtime garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors that trigger memory corruption, a different vulnerability than CVE-2008-2317. | [email protected] | 6.8 | 2.84% | 2008-07-14 | 2026-04-23 |