WebKitGTK, the WebKit port for GTK platforms, contains two vulnerabilities: CVE-2025-31205, which permits cross-origin data exfiltration by malicious websites, and CVE-2025-31257, which may cause Safari to crash unexpectedly when processing crafted web content. Red Hat's security advisory RHSA-2025:8533 provides updated webkit2gtk3 packages for Red Hat Enterprise Linux 9.0 across several architectures (ppc64le, x86_64, aarch64, s390x) to address these issues. The advisory classifies the security impact as Important and recommends applying the update after ensuring all prior errata are applied. No CVSS scores are provided in the advisory. No known exploits in the wild have been reported at this time.

Successful exploitation of CVE-2025-31205 could allow a malicious website to exfiltrate data across origins, potentially leading to unauthorized data disclosure. CVE-2025-31257 could cause an unexpected crash of Safari when processing malicious web content, potentially leading to denial of service. The advisory does not report any known active exploitation. The impact is rated as Important by Red Hat, indicating a significant security concern but not critical.

Red Hat has released updated webkit2gtk3 packages (version 2.48.2-1.el9_0) for Red Hat Enterprise Linux 9.0 on multiple architectures to address these vulnerabilities. Users should apply this security update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified or required beyond applying the official update.