EIP-2026-103708

PRE-CVE

WebKit - Universal XSS in WebCore::command

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-103708. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a race condition in WebKit's `execCommand` to execute arbitrary JavaScript in the context of a victim page. The vulnerability arises from a time-of-check to time-of-use (TOCTOU) issue where `updateStyleIfNeeded` can trigger JavaScript execution before document validation, allowing an attacker to inject malicious HTML.

Description

WebKit - Universal XSS in WebCore::command

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · htmldosmultiple
https://www.exploit-db.com/exploits/47451

This exploit leverages a race condition in WebKit's `execCommand` to execute arbitrary JavaScript in the context of a victim page. The vulnerability arises from a time-of-check to time-of-use (TOCTOU) issue where `updateStyleIfNeeded` can trigger JavaScript execution before document validation, allowing an attacker to inject malicious HTML.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Moderate
Reliability
Racy
Target: WebKit revision 246194, Safari 12.1.1 (14607.2.6.1.1)
No auth needed
Prerequisites: Victim page with a selected element (e.g., autofocused input) · Ability to open new windows or iframes
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026