Luakit WebKit Security Notice: What You Need to Know

Luakit's own documentation carries an explicit security warning: because Luakit is built on the WebKitGTK+ engine, your security depends on the version of WebKitGTK+ your distribution packages — not on Luakit itself. The project states that "not all distributions of Linux package the most up-to-date version of WebKitGTK+, and several package very outdated versions that have many known vulnerabilities." If you browse with Luakit, the documentation puts the responsibility on you: "it is your responsibility to ensure that your distribution packages an up-to-date version of WebKitGTK+."

Why the engine version matters more than the browser

Luakit is a browser framework: it provides the interface, keybindings, and Lua-based extensibility, while WebKitGTK+ does the actual rendering and page processing. That means patched vulnerabilities in the web engine reach you through your package manager's WebKitGTK+ package, not through a Luakit release. Running the newest Luakit on top of an old WebKitGTK+ leaves the known engine flaws in place.

The notice also notes a positive side: switching to the WebKit 2 API "means a vastly improved security situation" compared with the older API. The remaining risk is purely about how current the packaged engine is.

What the documentation says about distributions

As of September 2019, the project listed the following status:

Two caveats on reading this table:

• It is a snapshot dated September 2019. Package versions change, so verify your own system rather than relying on this list.
• It covers only the distributions named. If yours isn't listed, the notice gives no verdict either way — you still need to check.

How to check and act on your own system

The notice doesn't prescribe an exact command, but the practical steps follow from what it asks you to confirm — that your distribution ships an up-to-date WebKitGTK+:

1. Find your installed engine version. Query your package manager for the WebKitGTK+ package (commonly named webkit2gtk or similar) and note the version string.
2. Compare it against the current upstream release for WebKitGTK+.
3. If your distribution lags, you have three realistic options: enable a repository channel that carries a newer build, build WebKitGTK+ from source, or use a different browser for untrusted sites. The documentation does not recommend one over the others.
4. Re-check after distribution upgrades, since the gap can open or close with a release cycle.

Who this affects most

The notice is aimed at anyone who browses with Luakit, but the exposure is uneven:

• Users on a distribution the notice flagged as outdated (OpenSUSE stable, per the 2019 snapshot) face the clearest risk if nothing has changed since.
• Users who installed Luakit from source still depend on the system WebKitGTK+ package, so building Luakit yourself does not bypass the issue.
• Users on distributions that track current WebKitGTK+ have the smallest gap, though "current" is only as good as the last package update.

Practical takeaway

Treat WebKitGTK+ as the security-critical component of your Luakit setup and Luakit as the layer on top. Before relying on Luakit for everyday browsing, confirm your distribution's WebKitGTK+ version is current; if it isn't, either change how you obtain the engine or reserve Luakit for contexts where an outdated engine is acceptable. The project's own framing is unambiguous: keeping the engine patched is the user's job, not something Luakit can do for you.