Critical: webkit2gtk3 security, bug fix, and enhancement update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read (CVE-2026-87596)
* chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page (CVE-2026-87500)
* chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE (CVE-2026-87654)
* chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability (CVE-2026-87621)
* chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-fr
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
* webkitgtk: Processing maliciously
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699)
* webkitgtk: webkitgtk: A m
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28946)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28847)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28883)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28901)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpec
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
* webkitgtk: Processing maliciously crafted web content may disclose internal st
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
* webkitgtk: Processing maliciously crafted web content may disclose internal st
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: webkitgtk: Use-after-free due to improper memory management (CVE-2025-43529)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43501)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43531)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43535)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: WebKitGTK / WPE WebKit: Out-of-bounds read and integer underflow vulnerability leading to DoS (CVE-2025-13502)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2023-43000)
* webkitgtk: A website may exfiltrate image data cross-origin (CVE-2025-43392)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-43419)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43425)
* webkit
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43272)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43342)
* webkitgtk: A website may be able to access sensor information without user consent (CVE-2025-43356)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43368)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* angle: insufficient input validation can cause undefined behavior (CVE-2025-6558)
* webkitgtk: A download?s origin may be incorrectly associated (CVE-2025-43240)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-31273)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2025-31278)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2025-43211)
* webkitgtk: Processing maliciously crafted web content may lead to an u
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2025-31205)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-31257)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44192)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-54467)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2024-54551)
* webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack (CVE-2025-24208)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-24209)
* webkitgtk: Processing maliciousl
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44192)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-54467)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2024-54551)
* webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack (CVE-2025-24208)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-24209)
* webkitgtk: Processing maliciousl
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: out-of-bounds write vulnerability (CVE-2025-24201)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2024-54543)
* webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2025-24143)
* webkitgtk: Copying a URL from Web Inspector may lead to command injection (CVE-2025-24150)
* webkitgtk: Processing web content may lead to a denial-of-service (CVE-2025-24158)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-24162)
For more details about the security i
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* WebKitGTK: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-54479)
* webkit: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-54502)
* webkit: Processing maliciously crafted web content may lead to memory corruption (CVE-2024-54505)
* webkit: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-54508)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgment
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: data isolation bypass vulnerability (CVE-2024-44309)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866)
* webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44185)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44244)
* webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* webkit: visiting a malicious website may lead to address bar spoofing (CVE-2023-42843)
* webkit: heap use-after-free may lead to arbitrary code execution (CVE-2023-42950)
* webkit: processing malicious web content may lead to a denial of service (CVE-2023-42956)
* chromium-browser: Use after free in ANGLE (CVE-2024-4558)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional C