WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28946)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28847)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28883)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28901)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28902)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28903)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28904)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28905)
* webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-28907)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28942)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28947)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28953)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28955)
* webkitgtk: An app may be able to access sensitive user data (CVE-2026-28958)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43658)
* webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-43660)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified in webkit2gtk3, the GTK port of the WebKit web rendering engine. These include several issues where processing maliciously crafted web content may cause unexpected crashes in Safari or other processes, as well as a vulnerability allowing websites to access sensor information without user consent. Red Hat has issued an important security update for Red Hat Enterprise Linux 9 to address these issues.
Red Hat has issued a security advisory for webkit2gtk3 addressing two vulnerabilities in WebKitGTK, the WebKit port for the GTK platform. The first vulnerability (CVE-2025-31205) allows a malicious website to exfiltrate data across origins. The second vulnerability (CVE-2025-31257) can cause an unexpected crash of Safari when processing maliciously crafted web content. These issues have been rated as important by Red Hat Product Security. Updates are available for Red Hat Enterprise Linux 8.8 variants to address these vulnerabilities.
Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 9. These vulnerabilities include issues that may cause unexpected process crashes, denial-of-service conditions, cross-site scripting attacks, and cross-origin data exfiltration. An important security update is available from Red Hat to address these issues. Users of affected Red Hat Enterprise Linux 9 variants should apply the update to mitigate these risks.
An out-of-bounds write vulnerability (CVE-2025-24201) was identified in WebKitGTK, the GTK port of the WebKit rendering engine. This vulnerability affects the webkit2gtk3 package used in Red Hat Enterprise Linux 9 and related distributions. The issue has been rated with high severity by the vendor. A security update addressing this vulnerability is available from Red Hat and SUSE. The vulnerability is classified under CWE-787 (Out-of-bounds Write).
Red Hat has issued a security advisory for webkit2gtk3 addressing two vulnerabilities in WebKitGTK, the GTK port of the WebKit rendering engine. The first vulnerability (CVE-2024-54543) may lead to memory corruption when processing maliciously crafted web content. The second vulnerability (CVE-2025-24162) may cause an unexpected process crash under similar conditions. These issues affect Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. An update to webkit2gtk3 version 2.46.6-1.el9_2 has been released to address these vulnerabilities.
A security update for webkit2gtk3 addresses a data isolation bypass vulnerability (CVE-2024-44309) in WebKitGTK, the WebKit port for the GTK platform. This vulnerability has been rated as having an Important security impact by Red Hat. The update is available for Red Hat Enterprise Linux 8 across multiple architectures. The advisory references multiple CVEs related to webkitgtk, including CVE-2024-44309. No CVSS score is provided in the input data. The vendor advisory confirms that a fix is available in version 2.46.3-2.el8_10 of webkit2gtk3 packages.
CVE-2024-44309 is a vulnerability in the QtWebKit WebKitGTK port affecting cookie management and state isolation, allowing potential cross-site scripting (XSS) attacks via malicious web content. The issue has been fixed by Apple in Safari and iOS, and patches are available from Red Hat and Ubuntu for WebKitGTK packages. The vulnerability has been reported as potentially exploited on Intel-based Mac systems. Users should update to the fixed versions to mitigate risk.
Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 9. These vulnerabilities include address bar spoofing, cross-origin data exfiltration, unexpected process crashes, memory corruption, and potential arbitrary code execution triggered by processing malicious web content or files. Red Hat has issued an important security update (RHSA-2024:9553) that addresses these issues across various Red Hat Enterprise Linux 9 variants and architectures.