alsa-2026:25918
Vulnerability from osv_almalinux
Published
2026-06-15 00:00
Modified
2026-06-15 14:30
Summary
Important: webkit2gtk3 security update
Details

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28946)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28847)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28883)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28901)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28902)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28903)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28904)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28905)
  • webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-28907)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28942)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28947)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28953)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28955)
  • webkitgtk: An app may be able to access sensitive user data (CVE-2026-28958)
  • webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43658)
  • webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-43660)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References
https://access.redhat.com/errata/RHSA-2026:25918 ADVISORY
https://access.redhat.com/security/cve/CVE-2026-28847 REPORT
https://access.redhat.com/security/cve/CVE-2026-28883 REPORT
https://access.redhat.com/security/cve/CVE-2026-28901 REPORT
https://access.redhat.com/security/cve/CVE-2026-28902 REPORT
https://access.redhat.com/security/cve/CVE-2026-28903 REPORT
https://access.redhat.com/security/cve/CVE-2026-28904 REPORT
https://access.redhat.com/security/cve/CVE-2026-28905 REPORT
https://access.redhat.com/security/cve/CVE-2026-28907 REPORT
https://access.redhat.com/security/cve/CVE-2026-28942 REPORT
https://access.redhat.com/security/cve/CVE-2026-28946 REPORT
https://access.redhat.com/security/cve/CVE-2026-28947 REPORT
https://access.redhat.com/security/cve/CVE-2026-28953 REPORT
https://access.redhat.com/security/cve/CVE-2026-28955 REPORT
https://access.redhat.com/security/cve/CVE-2026-28958 REPORT
https://access.redhat.com/security/cve/CVE-2026-43658 REPORT
https://access.redhat.com/security/cve/CVE-2026-43660 REPORT
https://bugzilla.redhat.com/2471790 REPORT
https://bugzilla.redhat.com/2483955 REPORT
https://bugzilla.redhat.com/2483956 REPORT
https://bugzilla.redhat.com/2483957 REPORT
https://bugzilla.redhat.com/2483958 REPORT
https://bugzilla.redhat.com/2483959 REPORT
https://bugzilla.redhat.com/2483960 REPORT
https://bugzilla.redhat.com/2483961 REPORT
https://bugzilla.redhat.com/2483962 REPORT
https://bugzilla.redhat.com/2483963 REPORT
https://bugzilla.redhat.com/2483964 REPORT
https://bugzilla.redhat.com/2483965 REPORT
https://bugzilla.redhat.com/2483966 REPORT
https://bugzilla.redhat.com/2483967 REPORT
https://bugzilla.redhat.com/2483968 REPORT
https://bugzilla.redhat.com/2483969 REPORT
https://errata.almalinux.org/8/ALSA-2026-25918.html ADVISORY
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.52.4-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.52.4-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3-jsc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.52.4-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "webkit2gtk3-jsc-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.52.4-1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.  \n\nSecurity Fix(es):  \n\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28946)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28847)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28883)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28901)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28902)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28903)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28904)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28905)\n  * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-28907)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28942)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28947)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28953)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28955)\n  * webkitgtk: An app may be able to access sensitive user data (CVE-2026-28958)\n  * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43658)\n  * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-43660)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:25918",
  "modified": "2026-06-15T14:30:39Z",
  "published": "2026-06-15T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:25918"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28847"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28883"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28901"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28902"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28903"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28904"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28905"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28907"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28942"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28946"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28947"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28953"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28955"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28958"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43658"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43660"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2471790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483955"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483956"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483957"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483958"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483959"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483960"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483961"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483962"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483963"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483964"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483965"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483966"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483967"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483968"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2483969"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-25918.html"
    }
  ],
  "related": [
    "CVE-2026-28946",
    "CVE-2026-28847",
    "CVE-2026-28883",
    "CVE-2026-28901",
    "CVE-2026-28902",
    "CVE-2026-28903",
    "CVE-2026-28904",
    "CVE-2026-28905",
    "CVE-2026-28907",
    "CVE-2026-28942",
    "CVE-2026-28947",
    "CVE-2026-28953",
    "CVE-2026-28955",
    "CVE-2026-28958",
    "CVE-2026-43658",
    "CVE-2026-43660"
  ],
  "summary": "Important: webkit2gtk3 security update"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.