{"affected":[{"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:69098.json"},"package":{"ecosystem":"Rocky Linux:9","name":"webkit2gtk3","purl":"pkg:rpm/rocky-linux/webkit2gtk3?distro=rocky-linux-9&epoch=0"},"ranges":[{"database_specific":{"yum_repository":"AppStream"},"events":[{"introduced":"0"},{"fixed":"0:2.54.0-1.el9_8"}],"type":"ECOSYSTEM"}]}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}],"database_specific":{"license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","source_advisory":"RHSA-2026:69098"},"details":"WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)\n\n* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)\n\n* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)\n\n* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)\n\n* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)\n\n* webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)\n\n* webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)\n\n* webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)\n\n* webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)\n\n* webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)\n\n* chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)\n\n* webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)\n\n* webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)\n\n* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)\n\n* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","id":"RLSA-2026:69098","modified":"2026-09-22T18:24:41.151091788Z","published":"2026-09-22T18:04:11.996091Z","references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:69098"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2298302"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2307088"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2308415"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2308417"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2311665"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2314571"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2338161"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2343797"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444617"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446868"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447195"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449412"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456802"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458786"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458798"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463657"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467316"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467351"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467385"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477624"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477666"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482973"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482975"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483023"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483035"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483045"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483056"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483062"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483070"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483103"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483108"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483114"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484949"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484981"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484992"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485015"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485036"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485043"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485071"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485081"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485236"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485289"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485352"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485638"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486642"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486644"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495548"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495557"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495595"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495605"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495660"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496263"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496264"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496275"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496282"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496283"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496304"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496308"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500647"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500689"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2505966"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508687"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508726"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508773"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508809"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508884"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508941"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508949"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508987"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512231"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512277"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512287"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512341"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512360"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518263"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520315"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520316"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520317"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520319"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520320"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520321"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520322"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520323"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521858"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523847"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523904"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523912"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523958"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524104"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524106"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524566"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524567"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524568"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524569"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524570"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524571"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524573"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524574"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524575"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524576"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524578"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524579"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524580"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524581"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524582"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524583"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524584"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524585"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526490"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527168"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528197"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534512"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534705"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534759"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535531"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:69098"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","type":"CVSS_V3"}],"summary":"Important: webkit2gtk3 security update","upstream":["CVE-2023-4860","CVE-2024-7966","CVE-2024-8193","CVE-2024-8198","CVE-2024-8636","CVE-2024-9123","CVE-2025-0436","CVE-2025-0444","CVE-2026-10009","CVE-2026-10011","CVE-2026-10012","CVE-2026-10020","CVE-2026-10925","CVE-2026-10941","CVE-2026-10977","CVE-2026-10985","CVE-2026-10993","CVE-2026-11024","CVE-2026-11039","CVE-2026-11057","CVE-2026-11099","CVE-2026-11121","CVE-2026-11124","CVE-2026-11159","CVE-2026-11663","CVE-2026-11675","CVE-2026-13781","CVE-2026-13820","CVE-2026-13841","CVE-2026-13885","CVE-2026-13971","CVE-2026-14387","CVE-2026-14389","CVE-2026-14410","CVE-2026-14414","CVE-2026-14419","CVE-2026-14427","CVE-2026-14429","CVE-2026-15766","CVE-2026-15774","CVE-2026-16417","CVE-2026-17653","CVE-2026-17702","CVE-2026-17712","CVE-2026-17745","CVE-2026-17757","CVE-2026-17771","CVE-2026-17914","CVE-2026-17992","CVE-2026-19154","CVE-2026-19160","CVE-2026-19161","CVE-2026-19173","CVE-2026-19176","CVE-2026-28984","CVE-2026-3538","CVE-2026-3909","CVE-2026-3931","CVE-2026-43795","CVE-2026-43804","CVE-2026-4460","CVE-2026-5870","CVE-2026-6298","CVE-2026-6364","CVE-2026-64713","CVE-2026-64715","CVE-2026-64718","CVE-2026-64728","CVE-2026-64730","CVE-2026-64753","CVE-2026-64757","CVE-2026-64778","CVE-2026-64779","CVE-2026-64780","CVE-2026-64782","CVE-2026-64783","CVE-2026-64784","CVE-2026-64787","CVE-2026-65331","CVE-2026-65332","CVE-2026-65334","CVE-2026-65335","CVE-2026-65336","CVE-2026-65337","CVE-2026-65338","CVE-2026-65340","CVE-2026-65341","CVE-2026-65351","CVE-2026-7353","CVE-2026-76041","CVE-2026-78376","CVE-2026-78914","CVE-2026-78958","CVE-2026-79020","CVE-2026-79112","CVE-2026-79144","CVE-2026-79147","CVE-2026-7920","CVE-2026-7923","CVE-2026-7949","CVE-2026-83596","CVE-2026-84359","CVE-2026-84635","CVE-2026-85049","CVE-2026-8510","CVE-2026-8579","CVE-2026-91733","CVE-2026-91740","CVE-2026-91747","CVE-2026-9892","CVE-2026-9893","CVE-2026-9909","CVE-2026-9923","CVE-2026-9981","CVE-2026-9983","CVE-2026-9998"]}