---
id: "CVE-2019-8720"
kind: "vulnerability"
aliases: ["CVE-2019-8720"]
title: "WebKitGTK WebKitGTK: WebKitGTK Memory Corruption Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.01556
exploited: true
status: "open"
category: "runtime"
products: [{"name": "WebKitGTK WebKitGTK", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "gtk-apps", "linux", "runtime", "webkitgtk"]
not_affected_if: ["no-webkitgtk-installed"]
published_at: "2022-05-23T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8720", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-8720", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8720", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# WebKitGTK WebKitGTK: WebKitGTK Memory Corruption Vulnerability

WebKitGTK, the browser engine used by GTK applications, has a memory corruption bug that lets an attacker run code. CISA lists it in its known-exploited catalog, so attacks have been seen in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WebKitGTK WebKitGTK affected ? fixed ?

## Fix

Apply the vendor's WebKitGTK updates, as CISA instructs; the specific fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8720
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-8720
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-8720

## From the sources

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_