CVE-2019-8720

Q: What is the severity of CVE-2019-8720?

CVE-2019-8720 has a CVSS score of 8.8 (HIGH). CVE-2019-8720 is a memory corruption vulnerability in WebKit that allows arbitrary code execution when processing malicious web content. This affects any application using WebKit for web rendering, including browsers and web views in applications. Attackers can exploit this to take control of affected systems.

8.8 HIGH

Remote Code Execution

📋 TL;DR

CVE-2019-8720 is a memory corruption vulnerability in WebKit that allows arbitrary code execution when processing malicious web content. This affects any application using WebKit for web rendering, including browsers and web views in applications. Attackers can exploit this to take control of affected systems.

💻 Affected Systems

Products:

WebKitGTK
WebKit
Applications using WebKit rendering engine
GNOME Web (Epiphany)
WPE WebKit

Versions: WebKitGTK before 2.26.0, WebKit before fixes in September 2019

Operating Systems: Linux distributions with WebKitGTK, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Any application embedding WebKit for web content rendering is vulnerable. This includes email clients, document viewers, and other applications with web rendering capabilities.

📦 What is this software?

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Enterprise Linux Server Tus by Redhat

View all CVEs affecting Enterprise Linux Server Tus →

Enterprise Linux Server Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server Update Services For Sap Solutions →

Enterprise Linux Server Update Services For Sap Solutions by Redhat

View all CVEs affecting Enterprise Linux Server Update Services For Sap Solutions →

Enterprise Linux Workstation by Redhat

View all CVEs affecting Enterprise Linux Workstation →

Webkitgtk by Webkitgtk

View all CVEs affecting Webkitgtk →

Wpe Webkit by Wpewebkit

View all CVEs affecting Wpe Webkit →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise with attacker gaining full control, data theft, and lateral movement capabilities.

🟠

Likely Case

Remote code execution leading to malware installation, credential theft, or system disruption.

🟢

If Mitigated

Limited impact with proper sandboxing and memory protection mechanisms in place.

🌐 Internet-Facing: HIGH - Web browsers and web-rendering applications directly process untrusted internet content.

🏢 Internal Only: MEDIUM - Internal web applications using WebKit could be targeted through phishing or compromised internal sites.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires user interaction (visiting malicious website). CISA lists this as known exploited. Multiple memory corruption issues were addressed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: WebKitGTK 2.26.0 and later

Vendor Advisory: https://webkitgtk.org/security/WSA-2019-0005.html

Restart Required: Yes

Instructions:

1. Update WebKitGTK to version 2.26.0 or later. 2. For Linux distributions, use package manager: 'sudo apt update && sudo apt upgrade webkit2gtk' (Debian/Ubuntu) or 'sudo yum update webkit2gtk3' (RHEL/CentOS). 3. Restart all applications using WebKit.

🔧 Temporary Workarounds

Disable JavaScript

linux

Disable JavaScript in WebKit-based applications to prevent exploitation through malicious scripts

gsettings set org.gnome.Epiphany.web enable-javascript false
Configure application settings to disable JavaScript

Use alternative browser

all

Switch to browsers not using WebKit engine (Firefox, Chromium) for web browsing

🧯 If You Can't Patch

Implement strict network filtering to block access to untrusted websites
Use application sandboxing/containerization to limit impact of potential exploitation

🔍 How to Verify

Check if Vulnerable:

Check WebKitGTK version: 'pkg-config --modversion webkit2gtk-4.0' or 'webkit2gtk-4.0 --version'

Check Version:

pkg-config --modversion webkit2gtk-4.0

Verify Fix Applied:

Verify version is 2.26.0 or higher: 'pkg-config --modversion webkit2gtk-4.0 | grep -q "^2\.2[6-9]\|^[3-9]" && echo "Patched" || echo "Vulnerable"'

📡 Detection & Monitoring

Log Indicators:

Application crashes in WebKit processes
Unusual memory access patterns in system logs
Suspicious child process creation from browser processes

Network Indicators:

Connections to known malicious domains from WebKit applications
Unusual outbound traffic patterns following web browsing

SIEM Query:

process_name:"WebKit" AND (event_type:crash OR parent_process:unusual)

📊 Metadata

CVE ID: CVE-2019-8720

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-119

Published: March 6, 2023

Last Updated: November 18, 2025

🔗 References

https://bugzilla.redhat.com/show_bug.cgi?id=1876611 Issue Tracking,Third Party Advisory
https://webkitgtk.org/security/WSA-2019-0005.html Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1876611 Issue Tracking,Third Party Advisory
https://webkitgtk.org/security/WSA-2019-0005.html Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8720 US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Codeready Linux Builder by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Arm64 Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Ibm Z Systems Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Codeready Linux Builder For Power Little Endian Eus by Redhat

Enterprise Linux by Redhat

Enterprise Linux Desktop by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux Eus by Redhat

Enterprise Linux For Arm64 Eus by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Ibm Z Systems Eus by Redhat

Enterprise Linux For Power Big Endian by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Power Little Endian Eus by Redhat

Enterprise Linux For Scientific Computing by Redhat

Enterprise Linux Server by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server Aus by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Tus by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Enterprise Linux Server Update Services For Sap Solutions by Redhat

Enterprise Linux Workstation by Redhat

Webkitgtk by Webkitgtk

Wpe Webkit by Wpewebkit

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable JavaScript

Use alternative browser

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities