The Red Hat security advisory RHSA-2026:16056 addresses 18 distinct vulnerabilities in webkit2gtk3, the GTK platform port of WebKit. The flaws include multiple instances where processing maliciously crafted web content can cause unexpected crashes (denial-of-service), information disclosure, bypass of Same Origin Policy and Content Security Policy, user tracking through Safari web extensions, fingerprinting, and cross-site scripting attacks. These vulnerabilities affect Red Hat Enterprise Linux 8.4 Extended Update Support and Advanced Mission Critical Update Support variants. The advisory references specific bugzilla entries and CVEs for each issue, indicating a broad range of security weaknesses including memory safety errors (CWE-120, CWE-416), security policy bypass (CWE-346, CWE-693), information exposure (CWE-201), and cross-site scripting (CWE-79).

Exploitation of these vulnerabilities may lead to denial-of-service conditions via process crashes, unauthorized disclosure of internal application states, bypass of critical web security policies (Same Origin Policy and Content Security Policy), user tracking and fingerprinting, and cross-site scripting attacks. These impacts can compromise the confidentiality, integrity, and availability of affected systems and user data when processing malicious web content or visiting malicious websites.

Red Hat has released updated webkit2gtk3 packages that address these vulnerabilities. Users and administrators of affected Red Hat Enterprise Linux 8.4 systems should apply the security updates as detailed in Red Hat advisory RHSA-2026:16056 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional vendor advisories indicate that no action is required or that these issues are already mitigated without patching.