RHSA-2026:98455CriticalCVSS 9.6

Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update

Published
November 11, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (90)

CVE-2026-9998 →CVE-2026-10985 →CVE-2026-11099 · no recordCVE-2026-14414 →CVE-2026-19160 →CVE-2026-91733 →CVE-2026-106379 →CVE-2026-113106 →CVE-2026-7353 →CVE-2026-10925 →CVE-2026-11121 →CVE-2026-17745 →CVE-2026-9923 →CVE-2026-10020 →CVE-2026-11024 →CVE-2026-14427 →CVE-2026-17914 →CVE-2026-106399 →CVE-2026-3931 →CVE-2026-7949 →CVE-2026-14410 →CVE-2026-17653 →CVE-2026-118351 →CVE-2026-119261 →CVE-2026-6364 →CVE-2026-10012 →CVE-2026-14429 →CVE-2026-16417 →CVE-2026-17992 →CVE-2024-8193 →CVE-2026-6298 →CVE-2026-7923 →CVE-2026-9909 →CVE-2024-8198 →CVE-2026-5870 →CVE-2026-10009 →CVE-2026-10993 →CVE-2026-13841 →CVE-2026-14387 →CVE-2026-78914 →CVE-2026-11039 →CVE-2026-17702 →CVE-2026-79112 →CVE-2026-79144 →CVE-2026-118354 →CVE-2026-8510 →CVE-2026-9893 →CVE-2026-10977 →CVE-2026-11159 →CVE-2026-11663 →CVE-2026-119271 →CVE-2026-7920 →CVE-2026-10941 →CVE-2026-11675 →CVE-2026-13971 →CVE-2026-17757 →CVE-2026-91740 →CVE-2026-118340 →CVE-2024-9123 →CVE-2026-4460 →CVE-2026-15766 →CVE-2026-118348 →CVE-2023-4860 →CVE-2026-11057 →CVE-2026-13781 →CVE-2026-14389 →CVE-2026-17771 →CVE-2026-118319 →CVE-2024-8636 →CVE-2025-0444 →CVE-2026-9892 →CVE-2026-10011 →CVE-2026-14419 →CVE-2024-7966 →CVE-2026-9981 →CVE-2026-11124 →CVE-2026-13820 →CVE-2026-13885 →CVE-2026-15774 →CVE-2026-102325 →CVE-2025-0436 →CVE-2026-3538 →CVE-2026-9983 →CVE-2026-17712 →CVE-2026-65333 →CVE-2026-78958 →CVE-2026-84359 →CVE-2026-8579 →CVE-2026-79147 →CVE-2026-103629 →

📋 Description

CVE-2023-4860 — chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2024-7966 — chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page CVE-2024-8193 — chromium: skia: chromium: skia: Heap buffer overflow in Skia CVE-2024-8198 — chromium: skia: chromium: skia: Heap buffer overflow in Skia CVE-2024-8636 — chromium: skia: chromium: skia: Heap buffer overflow in Skia CVE-2024-9123 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome CVE-2025-0436 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2025-0444 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-3538 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-3931 — chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia CVE-2026-4460 — chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia CVE-2026-5870 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-6298 — chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia CVE-2026-6364 — chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia CVE-2026-7353 — chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia CVE-2026-7920 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-7923 — chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia CVE-2026-7949 — chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia CVE-2026-8510 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-8579 — chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia CVE-2026-9892 — chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2026-9893 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-9909 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-9923 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-9981 — chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2026-9983 — chromium-browser: skia: chromium-browser: skia: Type Confusion in Skia CVE-2026-9998 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-10009 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-10011 — chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2026-10012 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-10020 — chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia CVE-2026-10925 — chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia CVE-2026-10941 — chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia CVE-2026-10977 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-10985 — chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia CVE-2026-10993 — chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia CVE-2026-11024 — chromium-browser: skia: chromium-browser: skia: Stack buffer overflow in Skia CVE-2026-11039 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-11057 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-11099 — chromium-browser: skia: chromium-browser: skia: Vulnerability in Skia CVE-2026-11121 — chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia CVE-2026-11124 — chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia CVE-2026-11159 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-11663 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-11675 — chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia CVE-2026-13781 — chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia CVE-2026-13820 — chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia CVE-2026-13841 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-13885 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-13971 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-14387 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-14389 — chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia CVE-2026-14410 — chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2026-14414 — chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia CVE-2026-14419 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-14427 — chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia CVE-2026-14429 — chromium-browser: skia: chromium-browser: skia: Insufficient validation of untrusted input in Skia CVE-2026-15766 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-15774 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-16417 — chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized use in Skia CVE-2026-17653 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-17702 — chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia CVE-2026-17712 — chromium-browser: skia: chromium-browser: skia: Race in Skia CVE-2026-17745 — chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia CVE-2026-17757 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-17771 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-17914 — chromium-browser: skia: chromium-browser: skia: Side-channel information leakage in Skia CVE-2026-17992 — chromium-browser: skia: chromium-browser: skia: Uninitialized Use in Skia CVE-2026-19160 — chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized use in Google Chrome CVE-2026-65333 — webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2026-78914 — chromium-browser: skia: chromium-browser: skia: Information disclosure via uninitialized resource in Skia CVE-2026-78958 — chromium-browser: skia: chromium-browser: Uninitialized resource in Skia CVE-2026-79112 — chromium-browser: skia: chromium-browser: Out of bounds read in Skia CVE-2026-79144 — chromium-browser: skia: chromium-browser: Information leak in Skia CVE-2026-79147 — chromium-browser: skia: chromium-browser: skia: Information leak via crafted HTML page in Google Chrome CVE-2026-84359 — chromium-browser: skia: chromium-browser: Information leak in Skia CVE-2026-91733 — chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation CVE-2026-91740 — chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia CVE-2026-102325 — chromium-browser: skia: chromium-browser: Uninitialized resource in Skia CVE-2026-103629 — chromium-browser: skia: Integer overflow in Skia CVE-2026-106379 — chromium-browser: skia: Uninitialized resource in Skia CVE-2026-106399 — chromium-browser: skia: Out of bounds read in Skia CVE-2026-113106 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118319 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118340 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118348 — chromium-browser: skia: Improper input validation in Skia CVE-2026-118351 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118354 — chromium-browser: skia: Improper input validation in Skia CVE-2026-119261 — chromium-browser: skia: Buffer overflow in Skia CVE-2026-119271 — chromium-browser: skia: Uninitialized resource in Skia

🎯 Affected products47

  • Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-0:2.54.2-2.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-0:2.54.2-2.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-0:2.54.2-2.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-0:2.54.2-2.el9_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-0:2.54.2-2.el9_9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-0:2.54.2-2.el9_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el9_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el9_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debugsource-0:2.54.2-2.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debugsource-0:2.54.2-2.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debugsource-0:2.54.2-2.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debugsource-0:2.54.2-2.el9_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-debugsource-0:2.54.2-2.el9_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-0:2.54.2-2.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-0:2.54.2-2.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-0:2.54.2-2.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-0:2.54.2-2.el9_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-0:2.54.2-2.el9_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el9_9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el9_9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-jsc-0:2.54.2-2.el9_9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-jsc-0:2.54.2-2.el9_9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • webkit2gtk3-jsc-0:2.54.2-2.el9_9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +17 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp. This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction. To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface. Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality. Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to isolate browser renderer processes and prevent execution of untrusted graphics rendering workloads through unpatched Skia libraries: upgrade to Google Chrome 156.0.8078.73 (or the corresponding fixed Red Hat builds), which resolves memory corruption within the Skia component to eliminate out-of-bounds memory access inside the browser sandbox, closing crafted HTML page. Until patched, this is a concern on Chromium and Webkitgtk browser environments processing untrusted web content, so restrict user access to untrusted web content and enforce strict network filtering against external, untrusted web destinations. As a compensating measure, Enable ASLR to randomize renderer process memory layout and hinder reliable pointer calculations, Enforce non-executable page permissions (NX/XD bit) to block shellcode execution in data memory, Enforce full RELRO and PIE in browser binaries to prevent Global Offset Table overwrite, Enable Control Flow Integrity and Shadow Call Stack to validate indirect call targets and return addresses, Enable Arbitrary Code Guard on Windows to block dynamic allocation of executable memory pages, and Deploy EDR agents to monitor and detect anomalous post-exploitation behaviors or shell spawning from browser renderers. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium) Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce Control Flow Integrity and Shadow Call Stack to validate indirect call targets and block control-flow hijacking from memory corruption in Skia: upgrade to Google Chrome 156.0.8078.73 (or the corresponding fixed Red Hat builds), which resolves memory corruption within the Skia 2D graphics rendering engine, closing crafted HTML page. Until patched, this is a concern on users navigating to attacker-controlled or malicious websites on any platform using affected browsers, so restrict user navigation to trusted websites and prevent opening untrusted HTML pages or untrusted links in affected browser environments. As a compensating measure, randomize userspace process memory layouts via ASLR to impede deterministic code execution and ROP gadget chaining, enforce non-executable memory via NX/XD bit to block code execution from writable heap and stack pages, enable full RELRO and PIE to protect Global Offset Tables from overwrites and support complete address randomization, compile binaries with FORTIFY_SOURCE to terminate processes upon detecting runtime buffer overflows in standard library calls, apply kernel-level seccomp syscall filtering to restrict system calls and prevent sandbox escapes, and deploy endpoint detection and response monitoring to detect anomalous process spawning and post-exploitation execution. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-113 Control Flow Integrity (CFI / Shadow Call Stack) (high) Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce strict input validation on drawing primitives and rendered web content processed by the Skia graphics engine: upgrade to Google Chrome 156.0.8078.73+ (or the corresponding fixed Red Hat builds), which validates input in the Skia component to prevent sandbox code execution during web content rendering, closing crafted HTML page. Until patched, this is a concern on all platforms running Chromium or WebKitGTK rendering untrusted web content, so restrict browsing to trusted sites and avoid loading untrusted or attacker-controlled web content. As a compensating measure, validate image dimensions, path counts, and buffer sizes before memory allocation and rendering bounds operations in Skia, enable ASLR to randomize the browser renderer process address space and hinder reliable code execution, and enforce non-executable page permissions on renderer heap and stack allocations using NX/XD bit. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper input validation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (medium) Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to eliminate memory corruption in Skia graphics rendering routines processing untrusted web content: upgrade to Google Chrome 156.0.8078.73+ (or the corresponding fixed Red Hat builds), which fixes memory corruption in the Skia graphics component when rendering crafted web content, closing crafted HTML page. Until patched, this is a concern on Chromium and WebKitGTK browser users rendering untrusted HTML pages, so restrict user browsing to trusted sites and avoid opening untrusted or attacker-controlled HTML pages. As a compensating measure, enable Full RELRO and PIE to make the Global Offset Table read-only and randomize binary base…

🔗 References (94)