This advisory covers a set of 18 vulnerabilities in the webkitgtk4 package used in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The vulnerabilities include multiple instances where processing maliciously crafted web content can lead to unexpected crashes (CVE-2025-43213, CVE-2025-43214, CVE-2025-43457, CVE-2025-43511, CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20644, CVE-2026-20664, CVE-2026-28857), denial-of-service (CVE-2026-20652), information disclosure (CVE-2025-46299), bypass of Same Origin Policy (CVE-2026-20643), prevention of Content Security Policy enforcement (CVE-2026-20665), user fingerprinting (CVE-2026-20691), cross-site scripting (CVE-2026-28871), tracking through Safari web extensions (CVE-2026-20676), and processing restricted content outside the sandbox (CVE-2026-28859). These vulnerabilities collectively pose significant security risks when processing untrusted web content. Red Hat has released updated packages to address these issues.

Exploitation of these vulnerabilities may result in denial-of-service via unexpected process crashes, disclosure of internal application states, bypass of web security policies such as Same Origin Policy and Content Security Policy, user tracking and fingerprinting, cross-site scripting attacks, and potential sandbox escapes allowing processing of restricted web content. These impacts can compromise application stability, user privacy, and security boundaries within web browsing contexts.

Red Hat has released an important security update for webkitgtk4 in Red Hat Enterprise Linux 7 Extended Lifecycle Support that addresses these vulnerabilities. Users should apply the update as detailed in Red Hat advisory RHSA-2026:22136 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified or required beyond applying the official update.