CVE-2025-13947
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was found in WebKitGTK that allows remote, user-assisted information disclosure. The flaw is due to missing verification of the source of file drag-and-drop operations, enabling an attacker to read any file the user is permitted to access.
Risk Assessment
The risk involves potential leakage of sensitive user data, such as documents or system configurations, by abusing the file drag-and-drop mechanism in the browser.
Recommendation
It is recommended to immediately update WebKitGTK to the latest patched version. As a workaround, consider disabling file drag-and-drop support in the browser until the update is applied.
Other vulnerabilities in WebKitGTK
See all- CVE-2015-2330High
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
- CVE-2026-78376High
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
- CVE-2025-66287High
A flaw was found in WebKitGTK due to improper memory handling. Processing malicious web content can cause an unexpected process crash.
- CVE-2025-13502High
A flaw in WebKitGTK and WPE WebKit allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
Original NVD description (English source)
A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser.