Summary
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
* webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
* webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
* webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
* webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
* webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
* chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
* webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
* webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)
* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | webkit2gtk3 | 0:2.54.0-1.el9_8 |
Vulnerabilities 115
-
High 8.8
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds …
KEV Mar 13, 2026 -
Critical 9.6
Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromi…
-
Critical 9.6
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker wh…
-
Critical 9.6
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a san…
-
Critical 9.6
Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandb…
-
High 8.8CVE-2024-7966 Public exploit
Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromis…
-
High 8.8CVE-2024-8193 Public exploit
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the…
-
High 8.8CVE-2024-8636 Public exploit
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit …
-
High 8.8
Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds …
-
High 8.8
Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitr…
-
High 8.8
Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit …
-
High 8.8
Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap …
-
High 8.8
Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrar…
-
High 8.8
Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside …
-
High 8.8
Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out …
-
High 8.8
Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds…
-
High 8.8
Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of boun…
-
High 8.8
Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10…
-
High 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and …
-
High 8.8
Webkitgtk: use-after-free of jscvalue function parameters
A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.
-
High 8.8
Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
-
High 8.8
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insi…
-
High 8.8
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap c…
-
High 8.8
Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code ins…
-
High 8.3
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rende…
-
High 8.3
Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote…
-
High 8.3
Out of bounds write in Skia in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromise…
-
High 8.3
Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the rende…
-
High 8.3
Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rend…
-
High 8.3
Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the rend…
-
High 8.3
Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the …
-
High 8.3
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker wh…
-
High 8.3
Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the rende…
-
High 8.3
Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the render…
-
High 8.3
Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromise…
-
High 8.3
Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the …
-
High 8.3
Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the…
-
High 8.3
Use after free in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the render…
-
High 8.3
Out of bounds write in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the r…
-
High 8.3
Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised…
-
High 8.3
Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who …
-
High 8.3
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rende…
-
High 8.3CVE-2026-9998 Public exploit
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the ren…
-
High 8.1
This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Taho…
-
High 8.1
Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory…
-
High 7.5CVE-2024-8198 Public exploit
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the…
-
High 7.5
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the ren…
-
High 7.5
Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the rende…
-
High 7.5
Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromi…
-
High 7.5
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the ren…
-
Medium 6.5
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren…
-
Medium 6.5
Out of bounds read in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data …
-
Medium 6.5
Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially se…
-
Medium 6.5
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data v…
-
Medium 6.5
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren…
-
Medium 6.5
Insufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker wh…
-
Medium 6.5
Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised…
-
Medium 6.5
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sens…
-
Medium 6.5
Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potent…
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.…
-
Medium 6.5
Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sen…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10…
-
Medium 6.5
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.…
-
Medium 6.5
The issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.…
-
Medium 6.5
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS …
-
Medium 6.5
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS…
-
Medium 6.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10…
-
Medium 6.5
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read me…
-
Medium 6.5
Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the re…
-
Medium 6.5
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, mac…
-
Medium 6.5
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain poten…
-
Medium 6.3
Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap co…
-
Medium 5.8
Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the re…
-
Medium 5.5
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, Safari 27, iO…
-
Medium 5.4
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.…
-
Medium 5.3
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren…
-
Medium 5.3
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker wh…
-
Medium 5.3
Side-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain po…
-
Medium 5.3
Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rend…
-
Medium 4.3
Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data v…
-
Medium 4.3
Inappropriate implementation in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromi…
-
Medium 4.3
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data v…
-
Medium 4.3
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data v…
-
Medium 4.3
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.…
-
Medium 4.3
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.…
-
Medium 4.3
Heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially s…
-
Medium 4.3
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS…
-
Medium 4.3
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.…
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3CVE-2026-65351 Public exploit
This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadO…
-
Medium 4.3
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web o…
-
Medium 4.3
Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data …
-
Medium 4.3
Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin…
-
Low 3.1
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had comprom…
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the r…
-
Low 3.1
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the re…
-
Low 3.1
Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromi…
-
Low 3.1
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the re…
-
Low 3.1
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the re…
-
Low 3.1
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.1…
-
Low 3.1
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.1…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised th…
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the re…
-
Low 3.1
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Insufficient validation of untrusted input in Skia in Google Chrome prior to 148.0.7778.168 allowed a remote attacker w…
-
Low 3.1
Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the render…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2298302
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2307088
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2308415
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2308417
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2311665
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2314571
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2338161
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2343797
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2444617
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2446868
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2447195
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2449412
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456802
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458786
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2458798
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2463657
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467316
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467351
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467385
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477624
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477666
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482973
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482975
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483023
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483035
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483045
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483056
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483062
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483070
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483103
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483108
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2483114
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2484949
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2484981
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2484992
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2485015
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2485036
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2485043
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2485071