RHSA-2026:96080 — Red Hat Security Advisory: webkit2gtk3 security update

Fixed packages 9

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-debuginfo	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-debugsource	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-devel	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-devel-debuginfo	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc-debuginfo	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc-devel	0:2.54.2-2.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream	webkit2gtk3-jsc-devel-debuginfo	0:2.54.2-2.el8_10

Vulnerabilities 18

Critical 9.6

CVE-2026-118340

Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data …

Google Chrome chromium libskia Browsers Debian

Oct 27, 2026
Critical 9.6

CVE-2026-119261

Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the rende…

Google Chrome chromium Browsers Debian

Oct 30, 2026
High 8.8

CVE-2026-113106

Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the render…

Google Chrome chromium libskia Browsers Debian Ubuntu

Oct 20, 2026
High 8.8

CVE-2026-118348

Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit…

Google Chrome chromium libskia Browsers Debian

Oct 27, 2026
High 8.8

CVE-2026-118351

Use after free in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outs…

Google Chrome chromium libskia Browsers Debian

Oct 27, 2026
High 8.8

CVE-2026-118354

Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin…

Google Chrome chromium libskia Browsers Debian

Oct 27, 2026
High 8.8

CVE-2026-119271

Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised th…

Google Chrome chromium libskia Browsers Debian Ubuntu

Oct 30, 2026
High 8.8

CVE-2026-85049

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insi…

Google Chrome chromium libskia Browsers Debian

Sep 3, 2026
High 8.3

CVE-2026-91733

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised…

Google Chrome chromium libskia Browsers Debian

Sep 15, 2026
Medium 4.3

CVE-2026-102325

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin…

Google Chrome chromium chromium Browsers Debian Ubuntu Wolfi

Sep 29, 2026
Medium 4.3

CVE-2026-103629

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data vi…

Google Chrome chromium chromium Browsers Debian Ubuntu Wolfi

Oct 2, 2026
Medium 4.3

CVE-2026-106379

Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin…

Google Chrome chromium chromium Browsers Debian Wolfi

Oct 6, 2026
Medium 4.3

CVE-2026-118319

Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit…

Google Chrome chromium libskia Browsers Debian

Oct 27, 2026
Medium 4.3

CVE-2026-91740

Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin…

Google Chrome chromium libskia Browsers Debian

Sep 15, 2026
Medium 4.3

CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-ori…

Google Chrome chromium libskia Browsers Debian

Sep 17, 2026
Low 3.3

CVE-2026-106399

Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineeri…

Google Chrome chromium libskia Browsers Debian

Oct 6, 2026
Low 3.1

CVE-2026-84359

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rend…

Google Chrome chromium libskia Browsers Debian

Sep 1, 2026
Low 3.1

CVE-2026-91747

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the render…

Google Chrome chromium libskia Browsers Debian

Sep 15, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2527168
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528197
report
https://bugzilla.redhat.com/show_bug.cgi?id=2534512
report
https://bugzilla.redhat.com/show_bug.cgi?id=2534705
report
https://bugzilla.redhat.com/show_bug.cgi?id=2534759
report
https://bugzilla.redhat.com/show_bug.cgi?id=2537950
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543588
report
https://bugzilla.redhat.com/show_bug.cgi?id=2545277
report
https://bugzilla.redhat.com/show_bug.cgi?id=2546915
report
https://bugzilla.redhat.com/show_bug.cgi?id=2547009
report
https://bugzilla.redhat.com/show_bug.cgi?id=2556522
report
https://bugzilla.redhat.com/show_bug.cgi?id=2562464
report
https://bugzilla.redhat.com/show_bug.cgi?id=2562477
report
https://bugzilla.redhat.com/show_bug.cgi?id=2562479
report
https://bugzilla.redhat.com/show_bug.cgi?id=2562486
report
https://bugzilla.redhat.com/show_bug.cgi?id=2562496
report
https://bugzilla.redhat.com/show_bug.cgi?id=2563744
report
https://bugzilla.redhat.com/show_bug.cgi?id=2563759
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96080.json
report
https://access.redhat.com/security/cve/CVE-2026-84359
advisory
https://www.cve.org/CVERecord?id=CVE-2026-84359
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-84359
article
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html
article
https://issues.chromium.org/issues/514078656
report
https://access.redhat.com/security/cve/CVE-2026-85049
advisory
https://www.cve.org/CVERecord?id=CVE-2026-85049
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-85049
article
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html
article
https://issues.chromium.org/issues/553345874
report
https://access.redhat.com/security/cve/CVE-2026-91733
advisory
https://www.cve.org/CVERecord?id=CVE-2026-91733
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-91733
article
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html
article
https://issues.chromium.org/issues/540021213
report
https://access.redhat.com/security/cve/CVE-2026-91740
advisory
https://www.cve.org/CVERecord?id=CVE-2026-91740
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-91740
article
https://issues.chromium.org/issues/553122373

Red Hat Security Advisory: webkit2gtk3 security update

Fixed packages 9

Vulnerabilities 18

Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data …

Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the rende…

Type confusion in Skia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the render…

Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit…

Use after free in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outs…

Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin…

Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised th…

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insi…

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised…

Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin…

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data vi…

Uninitialized resource in Skia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin…

Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit…

Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin…

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-ori…

Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineeri…

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rend…

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the render…

References