CVE-2026-78376 is a use-after-free vulnerability in WebKitGTK affecting Red Hat Enterprise Linux 6. The issue occurs due to improper memory handling when processing malicious web content, which can cause memory corruption. This flaw could potentially allow remote code execution if exploited. Exploitation requires user interaction to process malicious content, typically through graphical applications that incorporate WebKitGTK. The vulnerability has a high CVSS v3.1 score of 8.8, reflecting network attack vector, low complexity, no privileges required, but user interaction needed, with high impact on confidentiality, integrity, and availability. The Red Hat advisory recommends avoiding processing untrusted web content and removing packages that depend on WebKitGTK where feasible. No official patch or remediation level is provided in the advisory as of the publication date.

Successful exploitation can lead to memory corruption, denial of service (application crash), information disclosure, and potentially remote code execution. The vulnerability affects confidentiality, integrity, and availability of affected systems. Exploitation requires user interaction to load malicious web content, typically via graphical applications using WebKitGTK. The vulnerability is rated high severity with a CVSS score of 8.8.

No official patch or fix is confirmed in the Red Hat advisory at this time. The vendor recommends not processing or loading untrusted web content with WebKitGTK. Additionally, consider removing packages that depend on WebKitGTK (such as evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp) if they are not required, noting that removal may impact GNOME functionality. WebKitGTK3 can be removed without breaking functionality as it is not required by any package. These mitigations reduce the attack surface until an official fix is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.