Back to Security Advisories
Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:25918)
ALSA-2026:25918 updates WebKitGTK on AlmaLinux 8, fixing sixteen vulnerabilities (CVE-2026-28946, CVE-2026-28847, CVE-2026-28883 and others) in the WebKit rendering engine — unexpected process and Safari crashes, with a use-after-free class (CWE-416) among them; aggregate CVSS 6.5. Update with dnf update webkit2gtk3 and restart any application using the WebKit view.
High
6.5 CVSS
AlmaLinux 8
What this means under a SharedLicense license
WebKitGTK renders web content inside desktop applications (mail clients, mini-browsers, documentation viewers) — malicious web content can crash or potentially exploit the embedding application through these memory-safety flaws.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28946) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28847) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28883) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28901) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28902) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28903) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28904) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28905) * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-28907) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28942) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28947) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28953) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28955) * webkitgtk: An app may be able to access sensitive user data (CVE-2026-28958) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43658) * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-43660) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Frequently Asked Questions
What is ALSA-2026:25918?
It is AlmaLinux's erratum for WebKitGTK on AlmaLinux 8, fixing sixteen WebKit vulnerabilities (CVE-2026-28946, CVE-2026-28847, CVE-2026-28883, CVE-2026-28901 through CVE-2026-28942 and others) — crafted web content causing unexpected crashes, with use-after-free (CWE-416) among the classes; aggregate CVSS 6.5.
Who is affected by WebKitGTK flaws?
Systems running applications that embed WebKitGTK — mail/news clients, help viewers and lightweight browsers on AlmaLinux 8 desktops or workstations. Headless hosting servers usually do not have it installed unless a GUI application pulled it in.
How do I apply the fix?
Run dnf update webkit2gtk3 (and related webkit packages), then restart any application that uses the WebKit view so it reloads the patched library.
Are these flaws remotely exploitable?
The trigger is malicious web content rendered through WebKitGTK — exploitation requires the user to view attacker-influenced content inside an embedding application, which is the standard browser-engine threat model rather than a direct server attack.
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System