A flaw in WebKitGTK allows an attacker to obtain data that the user is authorized to read by manipulating the file drag‑and‑drop feature. The vulnerability, a CWE‑346 weakness of information exposure, does not require elevated privileges; it only abuses the component’s failure to verify that a drag operation originates from outside the browser window. When an application allows external drag-and-drop, any file the user can open becomes readable to an attacker who can initiate the drag action, leading to confidentiality loss of local files.

The issue affects a wide range of Red Hat Enterprise Linux releases, from RHEL 6 and RHEL 7 through RHEL 9, including all extended and update support streams. The WebKitGTK component maintained by the WebKitGTK Team is the direct target of the flaw, and the vulnerability applies to all installations that use this library without a recent update.

The CVSS score of 7.4 indicates a high risk of exposure, while the EPSS score of less than 1 % shows that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in CISA’s KEV catalog, meaning no large‑scale exploitation has been documented. The attack requires user interaction to initiate drag‑and‑drop, which limits autonomous exploitation but still presents a significant threat to users who run applications built on WebKitGTK.