Summary
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121084)
* chromium-browser: angle: Use after free in ANGLE (CVE-2026-121148)
* chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-121197)
* chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-121249)
* chromium-browser: skia: Buffer overflow in Skia (CVE-2026-121086)
* chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121160)
* chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-121072)
* chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-121227)
* chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121032)
* chromium-browser: angle: Race condition in ANGLE (CVE-2026-121230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 27
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | webkit2gtk3 | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3 | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3 | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-debugsource | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-debugsource | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-debugsource | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-devel | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-devel | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-devel | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-devel-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-devel-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-devel-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-devel | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-devel | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-devel | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-devel-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-devel-debuginfo | 0:2.54.2-3.el8_10 |
| Rocky Linux · 8 | webkit2gtk3-jsc-devel-debuginfo | 0:2.54.2-3.el8_10 |
Vulnerabilities 10
-
Critical 9.6
Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code ou…
-
High 8.3
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the re…
-
High 8.3
Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitr…
-
High 7.4
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the…
-
High 7.4
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the…
-
High 7.4
Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory …
-
High 7.4
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised th…
-
Medium 6.5
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566301
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566326
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566349
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566371
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566373
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566387
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566441
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566476
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566482
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2566492
-
advisory
https://access.redhat.com/errata/RHSA-2026:99702