An excellent overview of WebKit, its various ports, and how those
ports receive security updates -- or any updates:
https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/
I'm glad that my browser, lariza, has already been ported to WebKit2.
I'm also glad that I'm using Arch Linux.