CVE-2021-42762
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass...
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
CVE-2021-42762- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
CVE-2021-42762- Updated
- 2026-11-02
EUVDEUVD-2021-29720 No score
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
EUVD-2021-29720- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4ch5-gr7v-q6wq No score
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass...
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
GHSA-4ch5-gr7v-q6wq- Updated
- 2026-11-02
OSVALPINE-CVE-2021-42762
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
ALPINE-CVE-2021-42762- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
OSV
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
CVE-2021-42762- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2021-42762
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
DEBIAN-CVE-2021-42762- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2025:10364
Red Hat Security Advisory: webkitgtk4 security update
- Record
RHSA-2025:10364- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-42762
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- Record
UBUNTU-CVE-2021-42762- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2021-0498 No score
Updated webkit2 packages fix security vulnerability
The webkit2 package has been updated to version 2.34.1, fixing several security issues and other bugs. See release notes for details.
- Record
MGASA-2021-0498- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1454-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
- CVE-2021-42762: Updated seccomp rules with latest changes from flatpak (bsc#1191937).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1454-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3603-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
- CVE-2021-42762: Updated seccomp rules with latest changes from flatpak (bsc#1191937).
- Record
openSUSE-SU-2021:3603-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3603-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
- CVE-2021-42762: Updated seccomp rules with latest changes from flatpak (bsc#1191937).
- Record
SUSE-SU-2021:3603-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3768-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
- CVE-2021-42762: Updated seccomp rules with latest changes from flatpak (bsc#1191937).
- Record
SUSE-SU-2021:3768-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3769-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
- CVE-2021-30846: Fixed memory corruption issue that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063).
- CVE-2021-30851: Fixed memory corruption vulnerability that could lead to arbitrary code execution when processing maliciously crafted web content (bsc#1192063).
- CVE-2021-42762: Updated seccomp rules with latest changes from flatpak (bsc#1191937).
- Record
SUSE-SU-2021:3769-1- Updated
- 2026-11-02
OSVUSN-5127-1 No score
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
- Record
USN-5127-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtkAlpine:v3.15 |
before 2.34.1-r0 | 2.34.1-r0 |
webkit2gtkAlpine:v3.16 |
before 2.34.1-r0 | 2.34.1-r0 |
webkit2gtkAlpine:v3.17 |
before 2.34.1-r0 | 2.34.1-r0 |
webkit2gtkAlpine:v3.18 |
before 2.34.1-r0 | 2.34.1-r0 |
webkit2gtkAlpine:v3.19 |
before 2.34.1-r0 | 2.34.1-r0 |
webkit2gtkAlpine:v3.20 |
before 2.34.1-r0 | 2.34.1-r0 |
webkit2gtkDebian:12 |
before 2.34.1-1 | 2.34.1-1 |
webkit2gtkDebian:13 |
before 2.34.1-1 | 2.34.1-1 |
webkit2gtkDebian:14 |
before 2.34.1-1 | 2.34.1-1 |
wpewebkitDebian:12 |
before 2.34.1-1 | 2.34.1-1 |
Show 57 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wpewebkitDebian:13 |
before 2.34.1-1 | 2.34.1-1 |
wpewebkitDebian:14 |
before 2.34.1-1 | 2.34.1-1 |
webkit2gtkDebian:10 From an advisory covering 10 CVEs |
before 2.34.1-1~deb10u1, plus listed versions 2.24.2-12.24.2-22.24.3-12.24.3-1~bpo10+12.24.3-1~bpo9+1 Show 45 moreShow less2.24.3-1~deb10u12.24.4-12.24.4-1~bpo10+12.24.4-1~bpo9+12.24.4-1~deb10u12.25.1-12.25.2-12.25.4-12.25.92-12.26.0-12.26.1-12.26.1-22.26.1-32.26.1-3~bpo10+12.26.1-3~bpo9+12.26.1-3~bpo9+22.26.1-3~deb10u12.26.2-12.26.2-1~bpo9+12.26.2-1~deb10+12.26.3-12.26.3-1~bpo10+12.26.3-1~bpo9+12.26.3-1~deb10u12.26.4-12.26.4-1~bpo9+12.26.4-1~bpo9+22.26.4-1~bpo9+32.26.4-1~deb10u12.26.4-1~deb10u22.26.4-1~deb10u32.27.1-12.27.2-12.27.3-12.27.4-12.27.90-12.27.91-12.28.0-12.28.0-22.28.0-2~bpo10+12.28.1-12.28.1-22.28.1-2~bpo10+12.28.2-12.28.2-2 |
2.34.1-1~deb10u1 |
webkit2gtkDebian:11 From an advisory covering 10 CVEs |
before 2.34.1-1~deb11u1, plus listed versions 2.32.3-12.32.4-12.32.4-1~deb10u12.32.4-1~deb11u12.33.1-1 Show 7 moreShow less2.33.2-12.33.3-12.33.90-12.33.91-12.34.0-12.34.0-1~bpo11+12.34.1-1~deb10u1 |
2.34.1-1~deb11u1 |
wpewebkitDebian:11 From an advisory covering 10 CVEs |
before 2.34.1-1~deb11u1, plus listed versions 2.32.3-22.32.4-12.32.4-1~deb11u1 |
2.34.1-1~deb11u1 |
webkit2Mageia:8 From an advisory covering 6 CVEs |
before 2.34.1-1.mga8 | 2.34.1-1.mga8 |
webkitgtk4Red Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-debuginfoRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-develRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-jscRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-jsc-develRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkitgtk4-docRed Hat:rhel_els:7 From an advisory covering 230 CVEs |
before 0:2.48.3-2.el7_9 | 0:2.48.3-2.el7_9 |
webkit2gtk3SUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 2.32.4-15.1 | 2.32.4-15.1 |
webkit2gtk3SUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 2.32.4-15.1 | 2.32.4-15.1 |
webkit2gtk3SUSE:Linux Enterprise Module for Desktop Applications 15 SP2 |
before 2.32.4-15.1 | 2.32.4-15.1 |
webkit2gtk3SUSE:Linux Enterprise Module for Desktop Applications 15 SP3 |
before 2.32.4-15.1 | 2.32.4-15.1 |
webkit2gtk3SUSE:HPE Helion OpenStack 8 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:OpenStack Cloud 8 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:OpenStack Cloud 9 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:OpenStack Cloud Crowbar 8 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:OpenStack Cloud Crowbar 9 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP2-BCL |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP3-LTSS |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP3-BCL |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP4-LTSS |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP5 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.32.4-2.74.5 | 2.32.4-2.74.5 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15-LTSS From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
webkit2gtk3SUSE:Enterprise Storage 6 From an advisory covering 3 CVEs |
before 2.34.1-3.87.1 | 2.34.1-3.87.1 |
qtwebkit-opensource-srcUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 |
None known |
webkit2gtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1 |
None known |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
webkitgtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 |
None known |
qtwebkit-opensource-srcUbuntu:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1 |
None known |
qtwebkit-sourceUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu13 |
None known |
webkitgtkUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3 |
None known |
webkit2gtkUbuntu:20.04:LTS |
before 2.34.1-0ubuntu0.20.04.1, plus listed versions 2.26.1-32.26.2-12.26.3-1ubuntu22.26.4-1ubuntu12.28.0-1ubuntu2 Show 10 moreShow less2.28.1-12.28.2-0ubuntu0.20.04.12.28.3-0ubuntu0.20.04.12.28.4-0ubuntu0.20.04.12.30.3-0ubuntu0.20.04.12.30.5-0ubuntu0.20.04.12.30.6-0ubuntu0.20.04.12.32.0-0ubuntu0.20.04.12.32.3-0ubuntu0.20.04.12.32.4-0ubuntu0.20.04.1 |
2.34.1-0ubuntu0.20.04.1 |
qtwebkit-opensource-srcUbuntu:20.04:LTS |
All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1 |
None known |
wpewebkitUbuntu:20.04:LTS |
All versions, plus listed versions 2.26.3-12.26.4-12.26.4-1build12.28.0-12.28.1-1 |
None known |
qtwebkit-opensource-srcUbuntu:22.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1 |
None known |
webkit2gtkUbuntu:22.04:LTS |
before 2.34.1-1ubuntu1, plus listed versions 2.34.0-1ubuntu1 |
2.34.1-1ubuntu1 |
wpewebkitUbuntu:22.04:LTS |
All versions, plus listed versions 2.32.4-12.34.1-12.34.2-12.34.3-12.34.4-1 Show 4 moreShow less2.34.5-12.34.6-12.36.0-2ubuntu22.36.0-2ubuntu3 |
None known |
qtwebkit-opensource-srcUbuntu:24.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36 |
None known |
webkit2gtkUbuntu:20.04:LTS From an advisory covering 3 CVEs |
before 2.34.1-0ubuntu0.20.04.1, plus listed versions 2.26.1-32.26.2-12.26.3-1ubuntu22.26.4-1ubuntu12.28.0-1ubuntu2 Show 10 moreShow less2.28.1-12.28.2-0ubuntu0.20.04.12.28.3-0ubuntu0.20.04.12.28.4-0ubuntu0.20.04.12.30.3-0ubuntu0.20.04.12.30.5-0ubuntu0.20.04.12.30.6-0ubuntu0.20.04.12.32.0-0ubuntu0.20.04.12.32.3-0ubuntu0.20.04.12.32.4-0ubuntu0.20.04.1 |
2.34.1-0ubuntu0.20.04.1 |
webkit2gtk3openSUSE:Leap 15.2 |
before 2.32.4-lp152.2.22.1 | 2.32.4-lp152.2.22.1 |
webkit2gtk3openSUSE:Leap 15.3 |
before 2.32.4-15.1 | 2.32.4-15.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-42762 is a medium vulnerability (CVSS 5.3) in Webkitgtk, published October 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in webkit2gtk 2.34.1-r0.
References
github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
bugs.webkit.org/show_bug.cgi?id=231479
openwall.com/lists/oss-security/2021/10/26/9
Show 194 moreShow less
debian.org/security/2021/dsa-4995
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4
nvd.nist.gov/vuln/detail/CVE-2021-42762
security.alpinelinux.org/vuln/CVE-2021-42762
security-tracker.debian.org/tracker/CVE-2021-42762
advisories.mageia.org/MGASA-2021-0498.html
bugs.mageia.org/show_bug.cgi?id=29596
webkitgtk.org/security/WSA-2021-0006.html
access.redhat.com/errata/RHSA-2025:10364
bugzilla.redhat.com/show_bug.cgi?id=1879532
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10364.json
cve.org/CVERecord?id=CVE-2014-1745
cisa.gov/known-exploited-vulnerabilities-catalog
talosintelligence.com/vulnerability_reports/TALOS-2020-1214
wpewebkit.org/security/WSA-2022-0007.html
seclists.org/fulldisclosure/2024/Mar/21
support.apple.com/en-us/120896
suse.com/support/update/announcement/2021/suse-su-20213603-1
bugzilla.suse.com/1191937
ubuntu.com/security/CVE-2021-42762
lists.opensuse.org/archives/list/[email protected]/thread/XQY7XF64DFNLXMA2OH345AZSHGVVPWBR
Left out here: 47 versions and 829 references. The JSON record has them.