This advisory covers a set of 18 security vulnerabilities in WebKitGTK, the GTK platform port of the WebKit engine, affecting Red Hat Enterprise Linux 8.6 variants. The vulnerabilities include multiple instances where processing maliciously crafted web content can cause unexpected crashes (including Safari crashes), denial-of-service conditions, information disclosure of internal application states, bypass of Same Origin Policy and Content Security Policy, user tracking via Safari web extensions, user fingerprinting, sandbox escape to process restricted content, and cross-site scripting attacks. These issues are tracked under CVE identifiers ranging from CVE-2025-43213 to CVE-2026-28871. Red Hat has issued an important security update (RHSA-2026:13845) to address these vulnerabilities. The update is available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory references detailed CVE pages for individual vulnerability impact and scoring.

The vulnerabilities may allow remote attackers to cause application or process crashes, leading to denial-of-service conditions. Some vulnerabilities enable information disclosure of internal application states, bypassing of critical web security policies (Same Origin Policy and Content Security Policy), user tracking and fingerprinting, processing of restricted content outside sandbox protections, and cross-site scripting attacks. These impacts can degrade the security posture of affected systems by undermining web content isolation, user privacy, and application stability. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update (RHSA-2026:13845) that addresses all listed vulnerabilities in WebKitGTK for affected Red Hat Enterprise Linux 8.6 variants. Users and administrators should apply this update promptly following the guidance at https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official patch. Patch status is confirmed as fixed by Red Hat Product Security.