Skip to content
Heist/ feed
UnratedFix available

Important: webkit2gtk3 security update

Type: advisorySource: OSV1 source record

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154) * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173) * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161) * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176) * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984) * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804) * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713) * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787) * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783) * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)

Announced Source revision 1
Original source ↗

ALSA-2026:69098

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:ALSA-2026:69098

webkit2gtk3

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
2.54.0-1.el9_8

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

webkit2gtk3-devel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
2.54.0-1.el9_8

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

webkit2gtk3-jsc

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
2.54.0-1.el9_8

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

webkit2gtk3-jsc-devel

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
2.54.0-1.el9_8

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.54.0-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "webkit2gtk3",
      "purl": "pkg:rpm/almalinux/webkit2gtk3",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:69098.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.54.0-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "webkit2gtk3-devel",
      "purl": "pkg:rpm/almalinux/webkit2gtk3-devel",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:69098.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.54.0-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "webkit2gtk3-jsc",
      "purl": "pkg:rpm/almalinux/webkit2gtk3-jsc",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:69098.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2.54.0-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "webkit2gtk3-jsc-devel",
      "purl": "pkg:rpm/almalinux/webkit2gtk3-jsc-devel",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:69098.json"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#60913 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement