The Red Hat security advisory RHSA-2026:11814 addresses 18 distinct vulnerabilities in webkit2gtk3, the GTK port of the WebKit engine. These vulnerabilities include multiple crash-inducing flaws (leading to denial-of-service), information disclosure, bypass of Same Origin Policy and Content Security Policy, user tracking via Safari web extensions, fingerprinting, and cross-site scripting. The issues stem from processing maliciously crafted web content or webpages. Affected products include Red Hat Enterprise Linux 8.8 variants. The advisory provides updated packages to remediate these vulnerabilities.

Exploitation of these vulnerabilities may lead to denial-of-service via unexpected process crashes, unauthorized disclosure of internal application states, bypass of web security policies (Same Origin Policy and Content Security Policy), user tracking and fingerprinting, and cross-site scripting attacks. These impacts can compromise the confidentiality, integrity, and availability of affected systems running vulnerable versions of webkit2gtk3. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for webkit2gtk3 that address all listed vulnerabilities. Users and administrators should apply the security update as described in the Red Hat advisory RHSA-2026:11814 (https://access.redhat.com/errata/RHSA-2026:11814) to remediate these issues. Patch status is confirmed as available. No additional mitigation actions are specified beyond applying the official update.