This advisory covers 18 distinct vulnerabilities in webkit2gtk3, the GTK port of the WebKit engine, as used in Red Hat Enterprise Linux 9.2 and related distributions. The vulnerabilities include multiple instances where processing maliciously crafted web content can cause unexpected crashes (CVE-2025-43213, CVE-2025-43214, CVE-2025-43457, CVE-2025-43511, CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20664, CVE-2026-28857), denial-of-service (CVE-2026-20652), information disclosure (CVE-2025-46299), bypass of Same Origin Policy (CVE-2026-20643), prevention of Content Security Policy enforcement (CVE-2026-20665), user tracking via Safari web extensions (CVE-2026-20676), user fingerprinting (CVE-2026-20691), processing restricted content outside sandbox (CVE-2026-28859), and cross-site scripting (CVE-2026-28871). These vulnerabilities collectively pose risks to application stability, user privacy, and web security. The Red Hat advisory RHSA-2026:16695 provides updated packages to remediate these issues.

The vulnerabilities may lead to application crashes, denial-of-service conditions, unauthorized disclosure of internal application states, bypass of web security policies (Same Origin Policy and Content Security Policy), user tracking and fingerprinting, sandbox escape, and cross-site scripting attacks. These impacts can compromise application availability, user privacy, and security boundaries within web content processing environments.

Red Hat has released an important security update for webkit2gtk3 in Red Hat Enterprise Linux 9.2 and related products to address these vulnerabilities. Users and administrators should apply the update as detailed in Red Hat advisory RHSA-2026:16695 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Patch status is confirmed as fixed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official update.