CVE-2023-39928

A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.

• CWE-416
• CWE-416

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202401-33
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1831Third Party Advisory
• https://webkitgtk.org/security/WSA-2023-0009.htmlVendor Advisory
• https://www.debian.org/security/2023/dsa-5527Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EEMDC5TQAANFH5D77QM34ZTUKXPFGVL/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202401-33
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1831Third Party Advisory
• https://webkitgtk.org/security/WSA-2023-0009.htmlVendor Advisory
• https://www.debian.org/security/2023/dsa-5527Third Party Advisory
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1831

Published

Oct 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-39921Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2023-39922Missing Authorization vulnerability in ThemeFusion Avada.Thi…8.8
• CVE-2023-39923Cross-Site Request Forgery (CSRF) vulnerability in RadiusThe…8.8
• CVE-2023-39924Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili…4.8
• CVE-2023-39925Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Do…8.8
• CVE-2023-39926Unauth. Stored Cross-Site Scripting (XSS) vulnerability in A…6.1
• CVE-2023-39929Uncontrolled search path in some Libva software maintained b…6.7
• CVE-2023-3993An issue has been discovered in GitLab EE affecting all vers…7.5
• CVE-2023-39930A first-factor authentication bypass vulnerability exists in…9.8
• CVE-2023-39932Uncontrolled search path in the Intel(R) SUR for Gameplay So…6.7
• CVE-2023-39933Insufficient verification vulnerability exists in Broadcast …4.3
• CVE-2023-39935Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2…8