RLSA-2026:91636: Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325)
chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331)
chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304)
chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247)
chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293)
chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/webkit2gtk3to a version that resolves this vulnerability.Fixed in 0:2.54.2-1.el8_10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What level of access does an attacker need to exploit these issues?
The supplied CVSS vector indicates network-based exploitation with low attack complexity and no privileges required. User interaction is required.
What could successful exploitation allow?
The CVSS vector rates confidentiality, integrity, and availability impact as high, indicating a successful exploit could have severe effects across all three areas.
Which vulnerability classes are addressed by this update?
The update addresses ANGLE flaws described as use-after-free, out-of-bounds write, out-of-bounds read, buffer overflow, type confusion, and uninitialized-resource issues. The listed CWE categories include Buffer Overflow and Use After Free.