Red Hat Product Security issued an advisory (RHSA-2026:9692) for webkit2gtk3 in Red Hat Enterprise Linux 9, addressing 18 CVEs involving security flaws in the WebKitGTK engine. These flaws include multiple causes of unexpected process crashes, denial-of-service conditions, information disclosure, bypass of Same Origin Policy and Content Security Policy, user tracking via Safari web extensions, fingerprinting, sandbox escapes, and cross-site scripting attacks. The vulnerabilities result from processing maliciously crafted web content. The advisory provides updated packages to fix these issues and references detailed CVE pages for each vulnerability.

The vulnerabilities may lead to denial-of-service through process crashes, disclosure of internal application states, bypass of critical web security policies, user tracking and fingerprinting, sandbox escapes allowing restricted content processing, and cross-site scripting attacks. These impacts can affect the confidentiality, integrity, and availability of affected systems running Red Hat Enterprise Linux 9 with webkit2gtk3. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated packages for webkit2gtk3 as part of Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:9692 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official update.