[ALSA-2026:69098] Important: webkit2gtk3 security update
Type:
security
Severity:
important
Release date:
2026-09-22
Description:
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154) * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173) * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161) * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176) * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984) * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804) * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713) * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787) * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783) * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376) * chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718) * webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340) * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351) * webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596) * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635) * webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 webkit2gtk3-2.54.0-1.el9_8.aarch64.rpm 153857c6de7307272aefb667dae222ef8b64c7b50411c5a802506abfcf45078a
aarch64 webkit2gtk3-devel-2.54.0-1.el9_8.aarch64.rpm 2f0fbd9134d306f5ad60b2c9b2fb319c3387355cb70468a9f9027368129f103d
aarch64 webkit2gtk3-jsc-2.54.0-1.el9_8.aarch64.rpm 4498f1ce671de3ab787c2a869dab0f7c5eaf6221655b7b09e2cee90bc8506b8f
aarch64 webkit2gtk3-jsc-devel-2.54.0-1.el9_8.aarch64.rpm bda4f4e6b7b66bb38b9f8715a9fa21af3afb1b2419fa2f4ff41045b0a0932b2f
i686 webkit2gtk3-jsc-devel-2.54.0-1.el9_8.i686.rpm 6ff571862e77603fe948c54e23843b38bb469eed7ec3fc40dcabaa565bca8475
i686 webkit2gtk3-2.54.0-1.el9_8.i686.rpm 97c0fe75c29db9a08fa19f0e47bab10fa4cfb249e1b4d1e78e87a65106155c14
i686 webkit2gtk3-jsc-2.54.0-1.el9_8.i686.rpm b7dfc7e95d64c6da8a1d9d5e790a82c3653a495f72fe5889230be8f377c3c3be
i686 webkit2gtk3-devel-2.54.0-1.el9_8.i686.rpm ff3919cc3a8424afbb3d5d7f68e4458267fed2b2237e88240d7effc2594b7971
ppc64le webkit2gtk3-jsc-devel-2.54.0-1.el9_8.ppc64le.rpm 825f5bb9ca615b813538b94eb2fffb4639d57dc0687358c29949668d4f002aa5
ppc64le webkit2gtk3-jsc-2.54.0-1.el9_8.ppc64le.rpm af4d5c7758bf616b21478ca714153ae840dce4687ae78da622fde1d0adc106ef
ppc64le webkit2gtk3-devel-2.54.0-1.el9_8.ppc64le.rpm c093f9a492793625c705ba66acd1cf61053fdc58d44dcaf0b87d3d016cead2ea
ppc64le webkit2gtk3-2.54.0-1.el9_8.ppc64le.rpm e2ca3fe4daecf6eb1ad2c4a8507be8b399d00eacb0343b1da819fc7fa43f81ce
s390x webkit2gtk3-devel-2.54.0-1.el9_8.s390x.rpm 57bc9d13b618cdd1bde08e2721189101f8d5a0d096f49852a45b44a3b727ef1f
s390x webkit2gtk3-jsc-devel-2.54.0-1.el9_8.s390x.rpm 58d920726fb2addf605d390ca24a008c508dd61e9c823a8640ddebc5414f3c15
s390x webkit2gtk3-2.54.0-1.el9_8.s390x.rpm 8154c9c5fecb8a484d018ae09a0633982b6f018fb0bbb2f32eda220d2c8db84a
s390x webkit2gtk3-jsc-2.54.0-1.el9_8.s390x.rpm b27059b8b62e4b7388bb949383959b190cf1d9e50706b84c5c65fe6c53751cc7
x86_64 webkit2gtk3-jsc-devel-2.54.0-1.el9_8.x86_64.rpm 4083a2e748606cd4d20ed9cd99fe52e1702749e49ef57de7a3875f85a7a54a16
x86_64 webkit2gtk3-devel-2.54.0-1.el9_8.x86_64.rpm 723a3d4235d0029be891a98f2aba9822337c3ba44856ec40c41e25469396b0ec
x86_64 webkit2gtk3-2.54.0-1.el9_8.x86_64.rpm 96b7dfa85ab65b830a95264b11a3911cf80e51a97fa8af18d1bf59f3ee9a679f
x86_64 webkit2gtk3-jsc-2.54.0-1.el9_8.x86_64.rpm 9cbfeaa2b9bcdd0b1f9daee53b720279585f947cb1ecd3cd735bebff62aa33cc
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.