{"schema_version": "1.7.0", "id": "RLSA-2026:69098", "modified": "2026-09-22T18:11:30.501930Z", "published": "2026-09-22T18:04:11.996091Z", "upstream": ["CVE-2023-4860", "CVE-2024-7966", "CVE-2024-8193", "CVE-2024-8198", "CVE-2024-8636", "CVE-2024-9123", "CVE-2025-0436", "CVE-2025-0444", "CVE-2026-10009", "CVE-2026-10011", "CVE-2026-10012", "CVE-2026-10020", "CVE-2026-10925", "CVE-2026-10941", "CVE-2026-10977", "CVE-2026-10985", "CVE-2026-10993", "CVE-2026-11024", "CVE-2026-11039", "CVE-2026-11057", "CVE-2026-11099", "CVE-2026-11121", "CVE-2026-11124", "CVE-2026-11159", "CVE-2026-11663", "CVE-2026-11675", "CVE-2026-13781", "CVE-2026-13820", "CVE-2026-13841", "CVE-2026-13885", "CVE-2026-13971", "CVE-2026-14387", "CVE-2026-14389", "CVE-2026-14410", "CVE-2026-14414", "CVE-2026-14419", "CVE-2026-14427", "CVE-2026-14429", "CVE-2026-15766", "CVE-2026-15774", "CVE-2026-16417", "CVE-2026-17653", "CVE-2026-17702", "CVE-2026-17712", "CVE-2026-17745", "CVE-2026-17757", "CVE-2026-17771", "CVE-2026-17914", "CVE-2026-17992", "CVE-2026-19154", "CVE-2026-19160", "CVE-2026-19161", "CVE-2026-19173", "CVE-2026-19176", "CVE-2026-28984", "CVE-2026-3538", "CVE-2026-3909", "CVE-2026-3931", "CVE-2026-43795", "CVE-2026-43804", "CVE-2026-4460", "CVE-2026-5870", "CVE-2026-6298", "CVE-2026-6364", "CVE-2026-64713", "CVE-2026-64715", "CVE-2026-64718", "CVE-2026-64728", "CVE-2026-64730", "CVE-2026-64753", "CVE-2026-64757", "CVE-2026-64778", "CVE-2026-64779", "CVE-2026-64780", "CVE-2026-64782", "CVE-2026-64783", "CVE-2026-64784", "CVE-2026-64787", "CVE-2026-65331", "CVE-2026-65332", "CVE-2026-65334", "CVE-2026-65335", "CVE-2026-65336", "CVE-2026-65337", "CVE-2026-65338", "CVE-2026-65340", "CVE-2026-65341", "CVE-2026-65351", "CVE-2026-7353", "CVE-2026-76041", "CVE-2026-78376", "CVE-2026-78914", "CVE-2026-78958", "CVE-2026-79020", "CVE-2026-79112", "CVE-2026-79144", "CVE-2026-79147", "CVE-2026-7920", "CVE-2026-7923", "CVE-2026-7949", "CVE-2026-83596", "CVE-2026-84359", "CVE-2026-84635", "CVE-2026-85049", "CVE-2026-8510", "CVE-2026-8579", "CVE-2026-91733", "CVE-2026-91740", "CVE-2026-91747", "CVE-2026-9892", "CVE-2026-9893", "CVE-2026-9909", "CVE-2026-9923", "CVE-2026-9981", "CVE-2026-9983", "CVE-2026-9998"], "summary": "Important: webkit2gtk3 security update", "details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)\n\n* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)\n\n* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)\n\n* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)\n\n* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)\n\n* webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)\n\n* webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)\n\n* webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)\n\n* webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)\n\n* webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)\n\n* chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)\n\n* webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)\n\n* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)\n\n* webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)\n\n* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)\n\n* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)\n\n* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}], "affected": [{"package": {"ecosystem": "Rocky Linux:9", "name": "webkit2gtk3", "purl": "pkg:rpm/rocky-linux/webkit2gtk3?distro=rocky-linux-9&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:2.54.0-1.el9_8"}], "database_specific": {"yum_repository": "AppStream"}}]}], "references": [{"type": "ADVISORY", "url": "https://errata.rockylinux.org/RLSA-2026:69098"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298302"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307088"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308415"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308417"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311665"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314571"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338161"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343797"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444617"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446868"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447195"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449412"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456802"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458786"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458798"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463657"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467316"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467351"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467385"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477624"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477666"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482973"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482975"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483023"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483035"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483045"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483056"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483062"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483070"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483103"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483108"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483114"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484949"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484981"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484992"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485015"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485036"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485043"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485071"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485081"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485236"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485289"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485352"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485638"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486642"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486644"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495548"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495557"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495595"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495605"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495660"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496263"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496264"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496275"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496282"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496283"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496304"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496308"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500647"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500689"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505966"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508687"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508726"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508773"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508809"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508884"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508941"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508949"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508987"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512231"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512277"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512287"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512341"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512360"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518263"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520315"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520316"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520317"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520319"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520320"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520321"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520322"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520323"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521858"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523847"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523904"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523912"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523958"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524104"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524106"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524566"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524567"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524568"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524569"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524570"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524571"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524573"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524574"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524575"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524576"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524578"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524579"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524580"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524581"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524582"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524583"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524584"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524585"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526490"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527168"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528197"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534512"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534705"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534759"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535531"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535532"}, {"type": "ADVISORY", "url": "https://access.redhat.com/errata/RHSA-2026:69098"}], "credits": [{"name": "Rocky Enterprise Software Foundation"}, {"name": "Red Hat"}], "database_specific": {"license": "CC-BY-4.0", "license_url": "https://creativecommons.org/licenses/by/4.0/", "source_advisory": "RHSA-2026:69098"}}