Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

ALSA-2026:96080 updates WebKitGTK on AlmaLinux 8 with a CVE-2026-84359 information-leak fix in Skia (alongside the previously shipped CVE-2026-85049/91747/91733/91740/93387/102325/103629/106379/106399/113106/1183xx series), aggregate CVSS 3.1 (CWE-200 information disclosure). Update with dnf update webkit2gtk3 and restart applications embedding the WebKit view.

High 3.1 CVSS 2026-11-09

AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

Information leaks in the Skia rendering layer expose fragments of process memory through crafted web content — lower severity than code execution, but the leaked bytes can contain session tokens or page data.

Type:

security

Severity:

important

Release date:

2026-11-09

Description:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
* chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)
* chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)
* chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)
* chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)
* chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)
* chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)
* chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)
* chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)
* chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)
* chromium-browser: skia: Use after free in Skia (CVE-2026-119271)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	webkit2gtk3-jsc-devel-2.54.2-2.el8_10.aarch64.rpm	2a10ef675e69c618487820415da2baaf2fd4f679f1b732ad3ad2a796bf412f9d
aarch64	webkit2gtk3-devel-2.54.2-2.el8_10.aarch64.rpm	c1d15abdf099171cffed404f910721fdaaaf584a0974626284e773be0eda9a7d
aarch64	webkit2gtk3-jsc-2.54.2-2.el8_10.aarch64.rpm	cb13c4989fd0df818037890cf8fb319bbd6fc8382b46d1633e3a4a911762ea99
aarch64	webkit2gtk3-2.54.2-2.el8_10.aarch64.rpm	d2bc06c13ffa71520d99a9499906371ab4f5ab78f1929a5210a6bdc89ae7baf6
i686	webkit2gtk3-jsc-2.54.2-2.el8_10.i686.rpm	1910fe534fd594f9d26593aa7f238dd08f49ccb740839837f8d38bc0358305ca
i686	webkit2gtk3-devel-2.54.2-2.el8_10.i686.rpm	a3037536f1f7f3f944ab3d81697fb547e48669585e38722a1ba46e0c157a64c1
i686	webkit2gtk3-jsc-devel-2.54.2-2.el8_10.i686.rpm	b82d53fa06fbc58ee774c531896d9ae9e1eb8b46620cc4bdce30dc478cfd4f42
i686	webkit2gtk3-2.54.2-2.el8_10.i686.rpm	e7dc1e74b3dd54517935a24a0999cc1e0ca050fb510522aebadb97adbb7309f8
ppc64le	webkit2gtk3-jsc-2.54.2-2.el8_10.ppc64le.rpm	1c0e8a77447872989b7d4f1dcd895d9b76f2b87c5af7cdc9a1de887fc0b52f8d
ppc64le	webkit2gtk3-2.54.2-2.el8_10.ppc64le.rpm	ae664f20bab86a8269480bab8253a6d159841b3877b4e1807fa313138cd7d2ac
ppc64le	webkit2gtk3-jsc-devel-2.54.2-2.el8_10.ppc64le.rpm	d28963effbb1df6191ab477a6d202f5e25f15edf962791c5c0e8190cd03a9da9
ppc64le	webkit2gtk3-devel-2.54.2-2.el8_10.ppc64le.rpm	d5cfc208e8c2a644a76e835f3adf7e4134665cde159967024c6ac18cc1726146
s390x	webkit2gtk3-jsc-devel-2.54.2-2.el8_10.s390x.rpm	18346da4aecb7c1c0d9805b92aa8fbb7d55010c6b23a014cd68d7a54a989b777
s390x	webkit2gtk3-2.54.2-2.el8_10.s390x.rpm	6c0e9e484778dac17f34e7b6bc378ba640ccacc6779034a1a31bb27a61be52ba
s390x	webkit2gtk3-devel-2.54.2-2.el8_10.s390x.rpm	a0c34450e40329650f53cc8f34a66d46b16cf3c25830730bcbed2ce40f23aac8
s390x	webkit2gtk3-jsc-2.54.2-2.el8_10.s390x.rpm	c6600a9d633e928b3c83175e5c0da413083ad060e45d48d8bd2e86cbb39c9dc2
x86_64	webkit2gtk3-jsc-devel-2.54.2-2.el8_10.x86_64.rpm	03d0c9405038c5e0559966765590632b217735815132bbd81cd0fa0e1c7a607f
x86_64	webkit2gtk3-devel-2.54.2-2.el8_10.x86_64.rpm	a85750d5b1fbb33b20a9a35958b545f90b61667db2cf50e37f4edf3e4fcd642a
x86_64	webkit2gtk3-jsc-2.54.2-2.el8_10.x86_64.rpm	b599055a5b9f64b7db7cd127161cb4d20ea2ba6dab83027d1e26fa7d4c1e3845
x86_64	webkit2gtk3-2.54.2-2.el8_10.x86_64.rpm	c4195ea9c6e53ce6a85f80b103f3e7feee2644b30da5c29298d2fee6a7868cbd

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:96080?

It is AlmaLinux's WebKitGTK erratum for AlmaLinux 8, fixing CVE-2026-84359 (information leak in Skia) along with the previously shipped CVE-2026-85049, CVE-2026-91747, CVE-2026-91733, CVE-2026-91740, CVE-2026-93387, CVE-2026-102325, CVE-2026-103629, CVE-2026-106379, CVE-2026-106399, CVE-2026-113106 and the CVE-2026-1183xx series. Aggregate CVSS 3.1 (CWE-200).

Who is affected?

AlmaLinux 8 systems running applications that embed WebKitGTK — mail clients, help viewers and lightweight browsers. Headless servers without the package are unaffected.

How do I apply the fix?

Run dnf update webkit2gtk3 and restart any application using the WebKit view so it reloads the patched engine.

Why apply a 3.1-CVSS update?

Because it rides the same package as the previously shipped fixes and information leaks compound — leaked memory fragments often contain the addresses or tokens needed to make the next, more serious exploit reliable.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen