CVE-2020-13753: Canonical Ubuntu Linux

Critical severity, CVSS 10.0. EPSS: 3.3% chance of exploitation in the next 30 days.

The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg-desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal's input buffer, similar to CVE-2017-5226.

Affected products

• Canonical Ubuntu Linux: version 18.04 only; version 19.10 only; version 20.04 only
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 31 only
• Opensuse Leap: version 15.1 only
• WebKitGTK WebKitGTK: before 2.28.3 (fixed in 2.28.3)
• Wpewebkit Wpe Webkit: before 2.28.3 (fixed in 2.28.3)

Published 2020-07-14. Last modified 2026-06-17.