Back Linuxsecurity

Debian: WebKitGTK Critical CVE-2025-43392 Exfiltration and Crash DSA-6070

Linuxsecurity •LinuxSecurity Advisories • December 4, 2025

CVE-2025-43392 Tom Van Goethem discovered that a website may exfiltrate image data cross-origin. CVE-2025-43425 An anonymous researcher discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43427 Gary Kwong and rheza discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43429 Google Big Sleep discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43430 Google Big Sleep discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43431 Google Big Sleep discovered that processing maliciously crafted web content may lead to memory corruption. CVE-2025-43432 Hossein Lotfi discovered that processing maliciously crafted web content may lead to an unexpected process crash. CVE-2025-43434

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Debian WebKitGTK Vulnerabilities Lead to Image Data Exfiltration and Crashes Multiple vulnerabilities in WebKitGTK have been identified, affecting Debian 11 users. Key issues include CVE-2025-43392, which allows cross-origin image data exfiltration, and several crash vulnerabilities (CVE-2025-43425, CVE-2025-43427, CVE-2025-43429) caused by processing malicious web content. These vulnerabilities were discovered by various researchers, including Tom Van Goethem and Gary Kwong. 6 sources 53

Extracted Entities

Debian: WebKitGTK Critical CVE-2025-43392 Exfiltration and Crash DSA-6070

The full story

Extracted Entities

Companies (1)

CVEs (8)

Platforms (1)