This advisory covers two security flaws in WebKitGTK used in Red Hat Enterprise Linux 8. CVE-2025-31205 is a cross-origin data exfiltration vulnerability that could allow malicious websites to access data from other origins improperly. CVE-2025-31257 involves a use-after-free or similar memory handling issue that may cause Safari to crash when processing crafted web content. Red Hat has released patched packages (webkit2gtk3-2.48.2-1.el8_10) for multiple architectures to address these issues. The advisory rates the impact as Important and provides instructions for applying the update.

Successful exploitation of CVE-2025-31205 could lead to unauthorized data exfiltration across origins, potentially compromising user data confidentiality. CVE-2025-31257 may cause denial of service through unexpected browser crashes. Both vulnerabilities affect the web rendering engine component, impacting applications relying on WebKitGTK. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for webkit2gtk3 (version 2.48.2-1.el8_10) that addresses these vulnerabilities. Users of affected Red Hat Enterprise Linux 8 systems should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated or required beyond applying the official patch.