CVE-2023-25358

What it actually does

Use-after-free in WebCore::RenderLayer::addChild allows attacker-controlled memory reuse during layer rendering, leading to arbitrary code execution in the WebKitGTK process.

Why it matters to the business

Systems using older WebKitGTK versions face risk of remote compromise when rendering untrusted web content, potentially exposing user data or enabling malware persistence on Linux desktops and applications that embed the library.

How an attack unfolds

An attacker hosts or compromises a webpage that triggers the vulnerable RenderLayer code path; when a victim application renders the page, the freed object is reused with attacker data, corrupting control flow and executing shellcode within the renderer process.

How to fix it

Upgrade WebKitGTK to version 2.36.8 or later; rebuild and restart any dependent applications or distributions such as Fedora packages that embed the library.

How to confirm the fix worked

Verify installed WebKitGTK version is 2.36.8 or newer via package manager or library headers; re-test affected web views with known trigger content to confirm absence of crash or memory corruption.

Typical attack path

1. Craft or compromise a webpage containing malicious HTML/CSS/JS that exercises RenderLayer::addChild
2. Deliver the page via phishing, compromised site, or embedded web view
3. Victim application parses and renders the content, triggering the use-after-free
4. Attacker reclaims the freed memory to hijack execution and run arbitrary code

How to detect it

Review application and system logs for unexpected crashes or segfaults in WebKitGTK or WebKitWebProcess processes; correlate with web traffic to recently visited or suspicious domains.

What your security team should do

• Immediately update all WebKitGTK packages to 2.36.8+ across servers and endpoints
• Scan inventories for applications embedding WebKitGTK and prioritize their updates
• Monitor for new exploit maturity signals given the stable low EPSS and lack of KEV listing