CVE-2019-8720: WebKit memory corruption allows code execution via crafted web content

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows remote code execution with user interaction and is confirmed exploited in CISA KEV, though EPSS probability is low and no ransomware use is documented.

What it is

WebKit contains multiple memory corruption issues in memory handling that are triggered when processing maliciously crafted web content. Successful exploitation can lead to arbitrary code execution in the context of the affected component. The flaw affects WebKitGTK, WPE WebKit and multiple Red Hat Enterprise Linux products.

Impact

An attacker can execute arbitrary code on the victim's system when the crafted content is processed, with high impact to confidentiality, integrity and availability. No privilege escalation is required beyond the code execution itself.

Attack surface

Reached over the network by delivering malicious web content to a WebKit-based browser or application; the CVSS vector indicates no privileges are needed but user interaction (viewing the content) is required.

Exploitation

CVE-2019-8720 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, though EPSS 30-day probability is low at roughly 1.6 percent. No ransomware campaign use is documented.

What to do

• Apply the vendor updates referenced in WebKitGTK security advisory WSA-2019-0005 and the corresponding Red Hat errata for affected Enterprise Linux packages.
• Prioritize patching per CISA KEV required action since the flaw is known to be exploited.
• Restrict or sandbox WebKit-based browsing and embedded web rendering where patching cannot be completed immediately.
• Track affected WebKitGTK, WPE WebKit and Red Hat Enterprise Linux product versions against vendor advisories to confirm coverage.

Detection

• Monitor for crashes or abnormal process termination in WebKitGTK/WPE WebKit rendering processes that may indicate memory corruption attempts.
• Hunt for unexpected child processes or outbound connections spawned by browser or web-rendering processes.
• Review endpoint telemetry for code execution originating from WebKit-based applications after visits to untrusted web content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.