This advisory covers 18 distinct vulnerabilities in webkit2gtk3, the WebKit port to GTK, as used in Red Hat Enterprise Linux 9.4 EUS. The vulnerabilities include multiple instances where processing maliciously crafted web content may cause unexpected crashes (CVE-2025-43213, CVE-2025-43214, CVE-2025-43457, CVE-2025-43511, CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20664, CVE-2026-28857), denial-of-service (CVE-2026-20652), information disclosure (CVE-2025-46299), bypass of Same Origin Policy (CVE-2026-20643), prevention of Content Security Policy enforcement (CVE-2026-20665), user tracking through Safari web extensions (CVE-2026-20676), user fingerprinting (CVE-2026-20691), processing restricted content outside sandbox (CVE-2026-28859), and cross-site scripting (CVE-2026-28871). These vulnerabilities collectively pose risks to application stability, user privacy, and web security policies. Red Hat has released patches for these issues in webkit2gtk3 version 2.52.3-1.el9_4.src.rpm for RHEL 9.4 EUS.

Exploitation of these vulnerabilities can lead to unexpected application or process crashes, denial-of-service conditions, disclosure of internal application states, bypass of critical web security policies such as Same Origin Policy and Content Security Policy, user tracking and fingerprinting, and cross-site scripting attacks. These impacts affect the security and privacy of users interacting with web content rendered by webkit2gtk3 on affected Red Hat Enterprise Linux systems.

Red Hat has issued an important security update for webkit2gtk3 addressing these vulnerabilities. Users should apply the update available for Red Hat Enterprise Linux 9.4 Extended Update Support as described in the Red Hat advisory RHSA-2026:14659 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the listed vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.