Skip to main content

🪐 Backed by $16.5M to build the security workforce for the security workforce. Meet the new Cantina.

Vulnerability disclosure

Thirteen-year WebKit flaw bypasses Content Security Policy

CVE-2026-43660

Affected product
WebKit
Severity
High
CVSS
7.5
Weakness
CWE-693
Published

Disclosure summary

CVE-2026-43660 is a high-severity CWE-693 vulnerability in WebKit. Thirteen-year WebKit flaw bypasses Content Security Policy. Cantina reproduced the behavior, verified its security impact, and coordinated disclosure with the affected maintainer.

Verification standard

Cantina publishes a disclosure only after reproducing the behavior, validating its security impact, and coordinating remediation with the affected project.