Red Hat Security Advisory: webkit2gtk3 security update
Multiple security vulnerabilities have been identified in webkit2gtk3, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 8.8 variants. These vulnerabilities include issues that may cause unexpected process crashes, denial-of-service, information disclosure, bypass of security policies such as Same Origin Policy and Content Security Policy, user tracking through Safari web extensions, fingerprinting, and cross-site scripting attacks. The vulnerabilities arise from processing maliciously crafted web content. Red Hat has issued an important security advisory with updates to address these issues.
AI Analysis
Technical Summary
The Red Hat security advisory RHSA-2026:11814 addresses 18 distinct vulnerabilities in webkit2gtk3, the GTK port of WebKit. The vulnerabilities include multiple instances where processing maliciously crafted web content can cause unexpected crashes (CVE-2025-43213, CVE-2025-43214, CVE-2025-43457, CVE-2025-43511, CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20664, CVE-2026-28857), denial-of-service (CVE-2026-20652), information disclosure (CVE-2025-46299), bypass of Same Origin Policy (CVE-2026-20643), prevention of Content Security Policy enforcement (CVE-2026-20665), user tracking via Safari web extensions (CVE-2026-20676), fingerprinting (CVE-2026-20691), processing restricted content outside the sandbox (CVE-2026-28859), and cross-site scripting (CVE-2026-28871). These vulnerabilities collectively represent significant risks when processing untrusted web content. The advisory provides updated packages for Red Hat Enterprise Linux 8.8 variants to remediate these issues.
Potential Impact
The vulnerabilities can lead to denial-of-service conditions through process crashes, potential information disclosure of internal application states, bypass of critical web security policies such as Same Origin Policy and Content Security Policy, user tracking and fingerprinting, and cross-site scripting attacks. These impacts could allow remote attackers or malicious websites to disrupt application availability, compromise user privacy, and execute unauthorized scripts, thereby undermining the security of applications relying on webkit2gtk3 for web content rendering.
Mitigation Recommendations
Red Hat has released updated webkit2gtk3 packages for Red Hat Enterprise Linux 8.8 variants to address these vulnerabilities. Users and administrators should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate the security issues. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as fixed in the updated packages referenced in RHSA-2026:11814.
Red Hat Security Advisory: webkit2gtk3 security update
Description
Multiple security vulnerabilities have been identified in webkit2gtk3, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 8.8 variants. These vulnerabilities include issues that may cause unexpected process crashes, denial-of-service, information disclosure, bypass of security policies such as Same Origin Policy and Content Security Policy, user tracking through Safari web extensions, fingerprinting, and cross-site scripting attacks. The vulnerabilities arise from processing maliciously crafted web content. Red Hat has issued an important security advisory with updates to address these issues.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat security advisory RHSA-2026:11814 addresses 18 distinct vulnerabilities in webkit2gtk3, the GTK port of WebKit. The vulnerabilities include multiple instances where processing maliciously crafted web content can cause unexpected crashes (CVE-2025-43213, CVE-2025-43214, CVE-2025-43457, CVE-2025-43511, CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20664, CVE-2026-28857), denial-of-service (CVE-2026-20652), information disclosure (CVE-2025-46299), bypass of Same Origin Policy (CVE-2026-20643), prevention of Content Security Policy enforcement (CVE-2026-20665), user tracking via Safari web extensions (CVE-2026-20676), fingerprinting (CVE-2026-20691), processing restricted content outside the sandbox (CVE-2026-28859), and cross-site scripting (CVE-2026-28871). These vulnerabilities collectively represent significant risks when processing untrusted web content. The advisory provides updated packages for Red Hat Enterprise Linux 8.8 variants to remediate these issues.
Potential Impact
The vulnerabilities can lead to denial-of-service conditions through process crashes, potential information disclosure of internal application states, bypass of critical web security policies such as Same Origin Policy and Content Security Policy, user tracking and fingerprinting, and cross-site scripting attacks. These impacts could allow remote attackers or malicious websites to disrupt application availability, compromise user privacy, and execute unauthorized scripts, thereby undermining the security of applications relying on webkit2gtk3 for web content rendering.
Mitigation Recommendations
Red Hat has released updated webkit2gtk3 packages for Red Hat Enterprise Linux 8.8 variants to address these vulnerabilities. Users and administrators should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate the security issues. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as fixed in the updated packages referenced in RHSA-2026:11814.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:11814
- Cve Count
- 18
- Additional Cves
- ["CVE-2025-43214","CVE-2025-43457","CVE-2025-43511","CVE-2025-46299","CVE-2026-20608","CVE-2026-20635","CVE-2026-20636","CVE-2026-20643","CVE-2026-20644","CVE-2026-20652","CVE-2026-20664","CVE-2026-20665","CVE-2026-20676","CVE-2026-20691","CVE-2026-28857","CVE-2026-28859","CVE-2026-28871"]
- Cvss Version
- null
Threat ID: 6a1df668e29bf47b504611ea
Added to database: 06/01/2026, 21:15:20 UTC
Last enriched: 07/15/2026, 14:41:20 UTC
Last updated: 07/31/2026, 19:24:46 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.