ALSA-2026:91580: Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325) chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331) chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304) chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247) chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293) chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/webkit2gtk3to a version that resolves this vulnerability.Fixed in 2.54.2-0.el9_8.1 - Upgrade
Upgrade
almalinux/webkit2gtk3-develto a version that resolves this vulnerability.Fixed in 2.54.2-0.el9_8.1 - Upgrade
Upgrade
almalinux/webkit2gtk3-jscto a version that resolves this vulnerability.Fixed in 2.54.2-0.el9_8.1 - Upgrade
Upgrade
almalinux/webkit2gtk3-jsc-develto a version that resolves this vulnerability.Fixed in 2.54.2-0.el9_8.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed packages are in scope for this advisory?
Review installations of almalinux/webkit2gtk3, almalinux/webkit2gtk3-devel, almalinux/webkit2gtk3-jsc, and almalinux/webkit2gtk3-jsc-devel.
Does the available advisory data say whether a default configuration is vulnerable or describe exploit prerequisites?
No. The provided data does not specify affected default configurations, attacker access requirements, or exploitation conditions.
Is there a documented workaround for systems that cannot be updated immediately?
No workaround or temporary mitigation is provided in the available advisory data.