CVE-2026-20643

Name	CVE-2026-20643
Description	A cross-origin issue in the Navigation API was addressed with improved input validation. This issue is fixed in Background Security Improvements for iOS, iPadOS, and macOS, Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, visionOS 26.4. Processing maliciously crafted web content may bypass Same Origin Policy.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
webkit2gtk (PTS)	bullseye	2.44.2-1~deb11u1	vulnerable
	bullseye (security)	2.50.4-1~deb11u1	vulnerable
	bookworm	2.50.4-1~deb12u1	vulnerable
	bookworm (security)	2.50.6-1~deb12u1	vulnerable
	trixie	2.50.4-1~deb13u1	vulnerable
	trixie (security)	2.50.6-1~deb13u1	vulnerable
	forky	2.50.6-1	vulnerable
	sid	2.52.0-1	vulnerable
wpewebkit (PTS)	bullseye, bullseye (security)	2.38.6-1~deb11u1	vulnerable
	bookworm	2.38.6-1	vulnerable
	trixie	2.48.3-1	vulnerable
	forky	2.50.6-1	vulnerable
	sid	2.52.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
webkit2gtk	source	bookworm	(unfixed)	end-of-life
webkit2gtk	source	(unstable)	2.52.1-1
wpewebkit	source	bullseye	(unfixed)	end-of-life
wpewebkit	source	(unstable)	2.52.1-1

Notes

[bookworm] - webkit2gtk <end-of-life> (webkit2gtk >= 2.52 can no longer be backported)
[trixie] - wpewebkit <ignored> (wpewebkit not covered by security support in Trixie)
[bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm)
[bullseye] - wpewebkit <end-of-life> (see #1035997)
https://webkitgtk.org/security/WSA-2026-0002.html