A flaw was found in WebKitGTK

WebKitGTK before 2.50.3 fails to verify that drag operations originate from outside the browser. A malicious page can attach arbitrary file:// URLs to its own drag source, and when the user drops that source onto a drop target (the page itself, or another app), the receiving target gets the *contents* of files the user account can read — not just the URLs. The class is CWE-346 (Origin Validation Error): WebKit treated an in-browser drag as a trusted local drag. The chain is unauthenticated and network-reachable, but it is hard-gated by user gesture (drag-and-drop) and only affects Linux/BSD desktops running WebKitGTK or WPE WebKit — Epiphany, GNOME Web, Geary's web view (not exploitable there — no JS in email), the GNOME help viewer, document viewers, Evolution previews, and anything embedding WebKitGTK as a widget. Apple WebKit on macOS/iOS is unaffected.

Vendor's HIGH (7.4) rating reflects worst-case C:H (read any file the user can read — SSH keys, ~/.aws/credentials, browser cookies, GPG keyrings) with scope change. That's directionally fair for a single-user Linux workstation but overstates fleet risk: AV:N is technically correct yet the chain requires the victim to actively drag a page element. Most enterprise fleets are Windows/macOS where this code path doesn't exist. We land at MEDIUM — the file-disclosure outcome is real and ugly on the boxes that *do* run WebKitGTK, but the user-gesture gate plus narrow desktop footprint takes the urgency down.

Why this verdict

• User interaction is a hard gate — UI:R here is not 'click a link', it is 'perform a multi-step drag-and-drop'. Phishing pages routinely get clicks; getting deliberate drags is materially harder.
• Footprint is narrow — affected component runs on Linux/BSD desktops only. Windows and macOS endpoints (the bulk of a 10k-host enterprise) are unaffected. Even on Linux, Firefox/Chromium dominate; Epiphany and other WebKitGTK browsers are a minority.
• Sandbox containment helps — Flatpak and Snap packaging of GNOME Web restrict the readable filesystem, reducing realistic payoff against the most common install vectors.
• Role multiplier: developer workstations with SSH keys, ~/.aws/credentials, kubeconfigs, and signing keys are the realistic worst-case role. Blast radius for a single dev box compromise is local-to-host, with credential-driven lateral pivot possible — but the affected component (a browser, not a domain controller / hypervisor / IdP / CA / PAM) does not sit in a high-value-role catalog slot. Chain ends in user-context credential theft, not domain takeover or fleet compromise. Role floor: MEDIUM.
• No KEV, low EPSS (0.3%), no public PoC — risk surface is theoretical-plus, not under active campaign pressure.
• Vendor 7.4 baseline is fair for a single-user view — we apply a friction-and-footprint discount of roughly 1.6 points to land at 5.8 MEDIUM, reflecting fleet-level reality rather than worst-case per-host.

Why not higher?

HIGH would require either active exploitation in the wild, KEV listing, a weaponized public PoC reducing the gesture barrier (e.g., a clickjacking/drag-jacking framework integrating this), or evidence that WebKitGTK is a non-trivial share of your endpoint estate. None of those conditions hold today. The user-gesture requirement is also stronger than typical UI:R clicks.

Why not lower?

LOW or IGNORE would be wrong because the outcome (C:H arbitrary file read in user context) is genuinely severe on affected hosts — SSH private keys and cloud credentials end careers. The bug is real, fixed, and any Linux developer workstation in scope deserves the patch within the standard window. Drag-jacking is a known social-engineering technique with real precedent; this is not theoretical.

1. Inventory WebKitGTK exposure — Run dpkg -l | grep -i webkit2gtk (Debian/Ubuntu) or rpm -qa | grep -i webkitgtk (RHEL/Fedora) across Linux fleet; identify hosts running Epiphany, GNOME Web, Evolution, Geary, or Flatpak apps bundling WebKitGTK. Complete within the noisgate mitigation SLA — n/a for MEDIUM, treat as triage input for the 365-day remediation window.
2. Push WebKitGTK 2.50.3+ via distro channels — Apply RHSA-2025:23742 on RHEL/derivatives; apt upgrade webkit2gtk on Debian/Ubuntu once backport lands; flatpak update for Flatpak-bundled WebKit apps. This is the actual fix — no workaround beats the patch. Target completion within the noisgate remediation SLA of 365 days, prioritized earlier for developer workstations holding production credentials.
3. Restrict WebKitGTK browsers via app allowlist — If your Linux endpoint management (Ansible, Puppet, Intune-for-Linux, JAMF Connect) supports app allowlisting, remove Epiphany / GNOME Web from developer images unless explicitly justified. Most Linux developers already use Firefox or Chromium.
4. Egress DLP rules on credential-shaped POSTs from browsers — Tune SWG / DLP to flag outbound HTTPS POSTs from browser processes containing BEGIN OPENSSH PRIVATE KEY, aws_access_key_id, AKIA[0-9A-Z]{16}, kubeconfig YAML markers. Catches not just this CVE but the broader credential-exfil class.
5. Move developer secrets out of plaintext dotfiles — Migrate SSH keys to hardware tokens (YubiKey, Secure Enclave on Macs that run a Linux VM), AWS credentials to short-lived SSO tokens via aws sso login, kubeconfigs to ephemeral OIDC flows. Reduces payoff of any file-read primitive, not just this CVE.

Run on each Linux endpoint as an unprivileged user. Invoke ./check-cve-2025-13947.sh directly — no root required. Reports VULNERABLE if any installed WebKitGTK/WPE WebKit is below 2.50.3, PATCHED if all installed copies are at or above the fix, UNKNOWN if no WebKitGTK packages are present.

#!/usr/bin/env bash
# check-cve-2025-13947.sh
# noisgate verification for CVE-2025-13947 (WebKitGTK drag-and-drop file disclosure)
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
FIX_VERSION="2.50.3"
FOUND_ANY=0
VULN=0

ver_lt() {
  # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  printf '%s\n%s\n' "$1" "$2" | sort -V -C
}

check_pkg() {
  local name="$1" ver="$2"
  FOUND_ANY=1
  if ver_lt "$ver" "$FIX_VERSION"; then
    echo "VULNERABLE: $name $ver (< $FIX_VERSION)"
    VULN=1
  else
    echo "OK:         $name $ver (>= $FIX_VERSION)"
  fi
}

# Debian / Ubuntu
if command -v dpkg-query >/dev/null 2>&1; then
  while IFS='|' read -r name ver status; do
    [ -z "$name" ] && continue
    echo "$status" | grep -q '^ii' || continue
    # Strip Debian epoch and revision for comparison
    ver_clean=$(echo "$ver" | sed -E 's/^[0-9]+://' | sed -E 's/-[^-]+$//')
    check_pkg "$name" "$ver_clean"
  done < <(dpkg-query -W -f='${Package}|${Version}|${db:Status-Abbrev}\n' \
           'webkit2gtk*' 'libwebkit2gtk*' 'wpewebkit*' 'libwpewebkit*' 2>/dev/null)
fi

# RHEL / Fedora / openSUSE
if command -v rpm >/dev/null 2>&1; then
  while IFS=' ' read -r name ver; do
    [ -z "$name" ] && continue
    check_pkg "$name" "$ver"
  done < <(rpm -qa --qf '%{NAME} %{VERSION}\n' \
           | grep -Ei '^(webkit2gtk|webkitgtk|wpewebkit)')
fi

# Flatpak runtimes (org.gnome.Platform bundles WebKitGTK)
if command -v flatpak >/dev/null 2>&1; then
  flatpak list --columns=application,version 2>/dev/null \
    | grep -iE 'webkit|epiphany|gnome-web' \
    | while read -r line; do
        echo "INFO: Flatpak entry — verify WebKitGTK version inside runtime: $line"
        FOUND_ANY=1
      done
fi

if [ "$FOUND_ANY" -eq 0 ]; then
  echo "UNKNOWN: no WebKitGTK / WPE WebKit packages detected on this host"
  exit 2
fi

if [ "$VULN" -eq 1 ]; then
  echo "RESULT: VULNERABLE — upgrade to WebKitGTK/WPE WebKit >= $FIX_VERSION"
  exit 1
fi

echo "RESULT: PATCHED"
exit 0

Sources

1. NVD — CVE-2025-13947
2. WebKitGTK Security Advisory WSA-2025-0009
3. WebKitGTK Security Advisory WSA-2025-0010
4. Michael Catanzaro — Significant Drag and Drop Vulnerability in WebKitGTK
5. Red Hat Security Advisory RHSA-2025:23742
6. Debian security tracker — webkit2gtk
7. Repology — webkitgtk vulnerabilities
8. CWE-346 — Origin Validation Error