webkitgtk-2.52.4

[Douglas R. Reno]

New point version

[Douglas R. Reno]

To help give me more details on what is going on here, I decided to check Apple's Security Advisory website and pick the updates from March 24th. After that I compared the commits in ​https://github.com/WebKit/WebKit/commits/webkitglib/2.52 against the WebKit bug numbers from the Safari 26.4 advisory.

I've come up with the following CVEs:

• CVE-2026-20665 (Processing maliciously crafted web content may prevent Content Security Policy from being enforced), 6.5 Medium

• CVE-2026-20643 (Processing maliciously crafted web content may bypass Same Origin Policy), 5.4 Medium

• CVE-2026-20664 (Processing maliciously crafted web content may lead to an unexpected process crash), 4.3 Medium

• CVE-2026-20691 (A maliciously crafted webpage may be able to fingerprint the user), 4.3 Medium

• CVE-2026-28861 (A malicious website may be able to access script message handlers intended for other origins), 4.3 Medium

• CVE-2026-28857 (Processing maliciously crafted web content may lead to an unexpected process crash), 6.5 Medium

• CVE-2026-28871 (Visiting a maliciously crafted website may lead to a cross-site scripting attack), Assessment not available as the issue was last updated on 3/25. Assuming High as a result.

• CVE-2026-28859 (A malicious website may be able to process restricted web content outside the sandbox), 4.3 Medium

There could possibly be others, but for now let's roll with this list pending a security advisory from upstream.

[Douglas R. Reno]

I haven't done any additional research further on this yet because building my laptop has been a very slow process due to a kernel bug (and needing to take care of non-LFS/personal responsibilities), but it has been reported that this package needs a patch from upstream to build with GTK-3.

[Xi Ruoyao]

​https://github.com/WebKit/WebKit/commit/40c315ca7b3ad6ae5c98d72a6927b3a75b43cb46.patch

I'm also hitting a runtime crash since 2.52.0: ​https://bugs.webkit.org/show_bug.cgi?id=309296. Per the discussion it seems we can do sed '/USE_COORDINATED_GRAPHICS_ASYNC_SCROLLBAR/s/1/0/' -i Source/WTF/wtf/PlatformUse.h use ​https://bugs.webkit.org/attachment.cgi?id=478833 as a workaround.

[Xi Ruoyao]

The final fixes for the issue above are ​https://github.com/WebKit/WebKit/commit/79b3c5ff16020d970c5e88a597232129ffe0d48a.patch ​https://github.com/WebKit/WebKit/commit/03ff5da2ebd8e21531763597b7f07720aa344e0d.patch.

[Douglas R. Reno]

Now 2.52.3

[pierre]

Note that gcc-16 breaks webkitgtk-2.52, not sure if this is fixed in later versions. See ​https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=683173671b134abeb2379bc77c0877f240421e2d.

[Xi Ruoyao]

Not yet. I just submitted it today: ​https://github.com/WebKit/WebKit/pull/65659

[pierre]

Can be implemented with a sed:

sed -e '/CodeOrigin/a #include "DFGBasicBlockInlines.h"' \
    -i Source/JavaScriptCore/dfg/DFGLoopUnrollingPhase.cpp

[pierre]

For the security issues, see ​https://webkitgtk.org/security/WSA-2026-0002.html. They have the same issues as the ones you found.

[Douglas R. Reno]

It looks like the change for building with gcc-16 is now in this release

[pierre]

webkit-2.52.4 fixes 16 CVE's! ​https://webkitgtk.org/security/WSA-2026-0003.html (I have not checked the ones that are relevant to webkitgtk

[Douglas R. Reno]

I'm going to reassign these to the book for now so whoever wants to do them can do them.

In the meantime I will continue working on rivendell, but I do not want to continue holding the project back on important issues.

[pierre]

Updated at 968bde834. Leaving open for SA

[Douglas R. Reno]

SA-13.0-124 issued. This one was a bit of a challenge for testing. Both Yelp and Epiphany had problems processing CSS, which caused the center of the window to contain all of the text and labels. Not entirely sure what happened here as it went away after I started trying different desktop environments (since I was in Plasma and the version of Plasma that BLFS 13.0 shipped with has some weird rendering quirks with Wayland sessions), but even after rebooting it now works in Plasma.

[Xi Ruoyao]

The proper scaling of the page content seems depending on gtk4 => xdg-desktop-portal now. When xdg-desktop-portal-gnome was not installed on my system all gtk4 applications have scaling issue with HiDPI (so I added a runtime dependency to the gtk4 page).

On another distro I observed a significant scaling issue of webkitgtk with Plasma 6: the page is down-scaled for a insanely large factor and webkitgtk frequently crashes with the insane layout. The initial diagnose suggests the monitor scaling factor seems miscalculated to zero on that system (so some floating-point calculations about scaling produces NaN and the Web Inspector shows those NaNs). My BLFS installation does not have KDE so I don't know if it affects BLFS as well.