Red Hat Product Security released an important security advisory (RHSA-2026:13845) for webkit2gtk3 on Red Hat Enterprise Linux 8.6 variants, addressing 18 CVEs related to processing maliciously crafted web content. The vulnerabilities include multiple causes of unexpected process or Safari crashes (CVE-2025-43213, CVE-2025-43214, CVE-2025-43457, CVE-2025-43511, CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20664, CVE-2026-28857), denial-of-service (CVE-2026-20652), information disclosure (CVE-2025-46299), bypass of same-origin policy (CVE-2026-20643), bypass of content security policy (CVE-2026-20665), user tracking via Safari web extensions (CVE-2026-20676), user fingerprinting (CVE-2026-20691), sandbox escape (CVE-2026-28859), and cross-site scripting (CVE-2026-28871). The advisory provides updated packages to remediate these issues.

The vulnerabilities may cause unexpected crashes of the Safari browser or other processes using webkit2gtk3, potentially leading to denial-of-service conditions. Some vulnerabilities allow disclosure of internal application states, bypassing of same-origin and content security policies, user tracking and fingerprinting, sandbox escapes, and cross-site scripting attacks. These issues can compromise application stability, user privacy, and security boundaries enforced by the browser engine.

Red Hat has released updated webkit2gtk3 packages for Red Hat Enterprise Linux 8.6 variants to address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:13845 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.