PatchGap
WebKit · WebKit

CVE-2026-43670

CSP Bypass in WebKit
High CVSS 8.8 webkit CSP Bypass

Overview

High
Severity
8.8
CVSS
No
Exploited ITW
Embargoed
Fix Status
DescriptionProcessing maliciously crafted web content may bypass Content Security Policy
ComponentWebKit
Bug ClassCSP Bypass
Tracker309004
CWECWE-693
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
Creditedlebr0nli of National Yang Ming Chiao Tung University, Security and Systems Lab
Disclosed2026-05-11

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.

Attack Path

  1. Step 1 Attacker serves a page with strict CSP blocking eval() and remote scripts.
  2. Step 2 Page creates an AudioWorklet or PaintWorklet.
  3. Step 3 Worklet runs without inheriting CSP, operating in a policy vacuum.
  4. Step 4 Attacker executes eval() or loads remote scripts inside worklet.
  5. Step 5 XSS or data exfiltration via attacker-controlled worklet code.

Original Bug Report

The reporter's bug is still restricted on the tracker.
On This Page