Skip to content
OpenAdvisories
High 1 exploited CVE ALSA-2026:69098 306 CVEs

Important: webkit2gtk3 security update

Published Sep 21, 2026 · Updated Oct 29, 2026

Summary

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
* webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
* webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
* webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
* webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
* webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
* chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
* webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
* webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)
* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 9 webkit2gtk3 2.54.0-1.el9_8
AlmaLinux · 9 webkit2gtk3-devel 2.54.0-1.el9_8
AlmaLinux · 9 webkit2gtk3-jsc 2.54.0-1.el9_8
AlmaLinux · 9 webkit2gtk3-jsc-devel 2.54.0-1.el9_8

Vulnerabilities 306

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-7532
  • report
    https://access.redhat.com/security/cve/CVE-2025-10502
  • report
    https://access.redhat.com/security/cve/CVE-2025-8901
  • report
    https://access.redhat.com/security/cve/CVE-2025-9478
  • report
    https://access.redhat.com/security/cve/CVE-2026-0908
  • report
    https://access.redhat.com/security/cve/CVE-2026-10018
  • report
    https://access.redhat.com/security/cve/CVE-2026-10019
  • report
    https://access.redhat.com/security/cve/CVE-2026-10881
  • report
    https://access.redhat.com/security/cve/CVE-2026-10883
  • report
    https://access.redhat.com/security/cve/CVE-2026-10889
  • report
    https://access.redhat.com/security/cve/CVE-2026-10907
  • report
    https://access.redhat.com/security/cve/CVE-2026-10913
  • report
    https://access.redhat.com/security/cve/CVE-2026-10914
  • report
    https://access.redhat.com/security/cve/CVE-2026-10919
  • report
    https://access.redhat.com/security/cve/CVE-2026-10929
  • report
    https://access.redhat.com/security/cve/CVE-2026-10930
  • report
    https://access.redhat.com/security/cve/CVE-2026-10955
  • report
    https://access.redhat.com/security/cve/CVE-2026-10974
  • report
    https://access.redhat.com/security/cve/CVE-2026-10979
  • report
    https://access.redhat.com/security/cve/CVE-2026-10994
  • report
    https://access.redhat.com/security/cve/CVE-2026-10999
  • report
    https://access.redhat.com/security/cve/CVE-2026-11004
  • report
    https://access.redhat.com/security/cve/CVE-2026-11005
  • report
    https://access.redhat.com/security/cve/CVE-2026-11040
  • report
    https://access.redhat.com/security/cve/CVE-2026-11043
  • report
    https://access.redhat.com/security/cve/CVE-2026-11044
  • report
    https://access.redhat.com/security/cve/CVE-2026-11051
  • report
    https://access.redhat.com/security/cve/CVE-2026-11055
  • report
    https://access.redhat.com/security/cve/CVE-2026-11061
  • report
    https://access.redhat.com/security/cve/CVE-2026-11065
  • report
    https://access.redhat.com/security/cve/CVE-2026-11066
  • report
    https://access.redhat.com/security/cve/CVE-2026-11087
  • report
    https://access.redhat.com/security/cve/CVE-2026-11088
  • report
    https://access.redhat.com/security/cve/CVE-2026-11090
  • report
    https://access.redhat.com/security/cve/CVE-2026-11104
  • report
    https://access.redhat.com/security/cve/CVE-2026-11109
  • report
    https://access.redhat.com/security/cve/CVE-2026-11110
  • report
    https://access.redhat.com/security/cve/CVE-2026-11111
  • report
    https://access.redhat.com/security/cve/CVE-2026-11113