RLSA-2026:99702: Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121084)
chromium-browser: angle: Use after free in ANGLE (CVE-2026-121148)
chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-121197)
chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-121249)
chromium-browser: skia: Buffer overflow in Skia (CVE-2026-121086)
chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121160)
chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-121072)
chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-121227)
chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121032)
chromium-browser: angle: Race condition in ANGLE (CVE-2026-121230)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/webkit2gtk3to a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-debugsourceto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-develto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-devel-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-jscto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-jsc-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-jsc-develto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10 - Upgrade
Upgrade
rocky-linux/webkit2gtk3-jsc-devel-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.54.2-3.el8_10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What attacker access and conditions are indicated by the severity vector?
The advisory’s CVSS vector indicates network reachability, low attack complexity, no required privileges, and required user interaction. It also indicates high potential impact to confidentiality, integrity, and availability.
Which Rocky Linux installations should be included in triage?
Include systems with webkit2gtk3 installed, along with installations of webkit2gtk3-devel, webkit2gtk3-jsc, and the listed debuginfo or debugsource packages. The advisory does not provide affected or fixed package versions, so package presence alone cannot establish patch status.