An  excellent  overview  of  WebKit,  its various ports, and how those
  ports receive security updates -- or any updates:

  https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/

  I'm glad that my browser, lariza, has already been ported to  WebKit2.
  I'm also glad that I'm using Arch Linux.