The following vulnerabilities have been discovered in the WebKitGTK
web engine:

CVE-2024-4367

Thomas Rinsma discovered that a type check was missing when
handling fonts in PDF.js, which would allow arbitrary JavaScript
execution in the PDF.js context.

CVE-2026-28847

DARKNAVY, an anonymous researcher and Daniel Rhea discovered...