This Red Hat security advisory addresses multiple vulnerabilities in webkit2gtk3, the GTK port of WebKit, impacting Red Hat Enterprise Linux 9.6 Extended Update Support. The vulnerabilities include unexpected process crashes (denial-of-service), information disclosure, bypass of Same Origin Policy and Content Security Policy, user tracking through Safari web extensions, fingerprinting, and cross-site scripting attacks. The issues arise from processing maliciously crafted web content or visiting maliciously crafted websites. The advisory references 18 CVEs ranging from CVE-2025-43213 to CVE-2026-28871. Red Hat has released updated packages to remediate these issues.

Successful exploitation of these vulnerabilities may cause unexpected process crashes leading to denial-of-service, disclosure of internal application states, bypass of critical web security policies (Same Origin Policy and Content Security Policy), user tracking and fingerprinting, and cross-site scripting attacks. These impacts can compromise application stability, user privacy, and web security enforcement within affected environments.

Red Hat has released updated webkit2gtk3 packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:11329 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.