id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
22189	qt6 qtwebengine 6.9.3	zeckma	Douglas R. Reno	"QtWebEngine hasn't released version 6.9.3 yet, but has updated Chromium upstream which fixes several security vulnerabilities, of which two are rated as Critical which allow for remote arbitrary code execution (ACE).

== Critical
- **CVE-2025-8879**: libaom heap buffer overflow, remote (High)
- **CVE-2025-8880**: ACE, remote (High)
- **CVE-2025-8881**: File picker allows leaking of cross-origin data via crafted HTML, remote (Medium)
- **CVE-2025-8901**: Out of bounds memory via crafted HTML, remote (High)
- **CVE-2025-9866**: Bypass content security policy via crafted HTML, remote (Medium)
- **CVE-2025-10200**: Use after free, heap corruption via crafted HTML, remote (Critical)
- **CVE-2025-10201**: Bypass site isolation via crafted HTML, remote (High)
- **CVE-2025-10500**: Use after free, Dawn (Reserved)
- **CVE-2025-10501**: Use after free, WebRTC (Reserved)
- **CVE-2025-10502**: Heap buffer overflow, ANGLE (Reserved)
- **CVE-2025-10585**: ACE, remote (Critical)
- **CVE-2025-54874**: Out of bounds heap memory write (related to OpenJPEG-2.5.4; see  #22175) (Medium)

We need to make a patch to fix these vulnerabilities. 6.9.3 is scheduled to come out in 7 days, plus time it will take for testing. With two remote ACE vulnerabilities on the table, 7+ days is not an option."	enhancement	closed	high	13.0	BOOK	git	critical	fixed