Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-h1tw-vmek-73b6
Vulnerability ID VCID-h1tw-vmek-73b6
Aliases CVE-2019-8506
Summary Multiple vulnerabilities have been found in WebkitGTK+, the worst of which could result in the arbitrary execution of code.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
epss 0.08064 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.08064 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.08064 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.08064 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.08064 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.08064 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.08064 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
cvssv3.1 8.8 https://support.apple.com/HT209599
ssvc Attend https://support.apple.com/HT209599
cvssv3.1 8.8 https://support.apple.com/HT209601
ssvc Attend https://support.apple.com/HT209601
cvssv3.1 8.8 https://support.apple.com/HT209602
ssvc Attend https://support.apple.com/HT209602
cvssv3.1 8.8 https://support.apple.com/HT209603
ssvc Attend https://support.apple.com/HT209603
cvssv3.1 8.8 https://support.apple.com/HT209604
ssvc Attend https://support.apple.com/HT209604
cvssv3.1 8.8 https://support.apple.com/HT209605
ssvc Attend https://support.apple.com/HT209605
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
https://api.first.org/data/v1/epss?cve=CVE-2019-8506
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8506
1719199 https://bugzilla.redhat.com/show_bug.cgi?id=1719199
CVE-2019-8506 Exploit https://bugs.chromium.org/p/project-zero/issues/detail?id=1753
CVE-2019-8506 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/46647.js
GLSA-201909-05 https://security.gentoo.org/glsa/201909-05
HT209599 https://support.apple.com/HT209599
HT209601 https://support.apple.com/HT209601
HT209602 https://support.apple.com/HT209602
HT209603 https://support.apple.com/HT209603
HT209604 https://support.apple.com/HT209604
HT209605 https://support.apple.com/HT209605
RHSA-2019:3553 https://access.redhat.com/errata/RHSA-2019:3553
RHSA-2020:4035 https://access.redhat.com/errata/RHSA-2020:4035
USN-3948-1 https://usn.ubuntu.com/3948-1/
Data source KEV
Date added May 4, 2022
Description A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Required action Apply updates per vendor instructions.
Due date May 25, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Ransomware campaign use Unknown
Data source Exploit-DB
Date added April 3, 2019
Description WebKit JavaScriptCore - 'createRegExpMatchesArray' Type Confusion
Ransomware campaign use Known
Source publication date April 3, 2019
Exploit type dos
Platform multiple
Source update date April 3, 2019
Source URL https://bugs.chromium.org/p/project-zero/issues/detail?id=1753
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209599
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209599
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209601
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209601
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209602
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209602
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209603
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209603
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209604
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209604
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209605
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209605
Exploit Prediction Scoring System (EPSS)
Percentile 0.92104
EPSS Score 0.08064
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:30.479476+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/201909-05 38.0.0