Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:42088)

This is a security release for AlmaLinux 8. The fix ships in the current release line (referenced builds: 52.5-1). Update the product on every affected server to the patched release — there is no workaround, and unpatched servers remain exposed until updated.

High 2026-07-21

AlmaLinux 8

Fix Commands

EL8+ (AlmaLinux/CloudLinux/Rocky)

sudo dnf update

What this means under a SharedLicense license

webkitgtk: on AlmaLinux 8 is the exposure surface; the advisory's own severity data tops out at CVSS .

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

Type:

security

Severity:

important

Release date:

2026-07-21

Description:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699)
* webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701)
* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712)
* webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713)
* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720)
* webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721)
* webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43725)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43726)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43727)
* webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731)
* webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information (CVE-2026-43732)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43734)
* webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43742)
* webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	webkit2gtk3-jsc-2.52.5-1.el8_10.aarch64.rpm	769f6035a41adeaaa28d1f671159e40540deb2c32c046efda63a8072d6e49832
aarch64	webkit2gtk3-devel-2.52.5-1.el8_10.aarch64.rpm	941a49bdb2fe2fb6812ab082480269babaab40425e356a4a029eef34aab3750f
aarch64	webkit2gtk3-jsc-devel-2.52.5-1.el8_10.aarch64.rpm	9c53c702a6916edd1f5f4bbd75de2f50e978e9cf4bf2296340f3645e8bceca35
aarch64	webkit2gtk3-2.52.5-1.el8_10.aarch64.rpm	d26b58621c9982464167a1c10e5ad185888f860dcec9aef89a7c0d3aa4217df1
i686	webkit2gtk3-2.52.5-1.el8_10.i686.rpm	12750db19e9534120a9f5aa57ca0947fdbaeef8bc02b0f1265f57e0d7013f423
i686	webkit2gtk3-jsc-devel-2.52.5-1.el8_10.i686.rpm	2efe968e0106abf1a5e6162face17c431497261e4dfc3be6d7863594f0a39534
i686	webkit2gtk3-devel-2.52.5-1.el8_10.i686.rpm	ad87015ee13d8678dc4de675c189626d0e5cb2a84f848968d74778d8623b6b77
i686	webkit2gtk3-jsc-2.52.5-1.el8_10.i686.rpm	e11af47a46c9bb9f98215409307d620a28ae825580c490cdc4a5eacd7de41f10
ppc64le	webkit2gtk3-jsc-2.52.5-1.el8_10.ppc64le.rpm	1a3c565cdc71a112e52cd42422d5a4feae73c6f12166384570e96911ab24966f
ppc64le	webkit2gtk3-devel-2.52.5-1.el8_10.ppc64le.rpm	1d309beeaaaa57eb6d52bb4cd696e253b15a9699c60966f85752b8e9287871d7
ppc64le	webkit2gtk3-2.52.5-1.el8_10.ppc64le.rpm	d4c1207596c6bab882e24d7f38d076fc3e7826ca102f7fbcaecc8ca0a3b2ad08
ppc64le	webkit2gtk3-jsc-devel-2.52.5-1.el8_10.ppc64le.rpm	d549ba69e5337bf5cee4a6ef1ac800b076f456a28f0a31c7d8d72f412012fbcc
s390x	webkit2gtk3-devel-2.52.5-1.el8_10.s390x.rpm	10448eb7426680e1aca923aad1fb9614898ce680225d593f060e33401dcca439
s390x	webkit2gtk3-2.52.5-1.el8_10.s390x.rpm	2f0cad9af03d872f991950606c7b5e97fe266236702768205a6c8ed2545527c1
s390x	webkit2gtk3-jsc-devel-2.52.5-1.el8_10.s390x.rpm	b10124c34c01ed2d8f7db371fcb581eb0738e339b798d9c2b899fc8a3b24f9eb
s390x	webkit2gtk3-jsc-2.52.5-1.el8_10.s390x.rpm	f1d8e0f116cf04080dd2189a5386483e52d8db8f5e30217a702d55d435c3a58b
x86_64	webkit2gtk3-jsc-2.52.5-1.el8_10.x86_64.rpm	16991a6761b6826594b2dfc34e2603398abc0990b8775f44cfec8590a42e9bcc
x86_64	webkit2gtk3-devel-2.52.5-1.el8_10.x86_64.rpm	4cd5c269cce99678f3cdba9f375ad0b8870110fff4c78705605c6e26b595d290
x86_64	webkit2gtk3-2.52.5-1.el8_10.x86_64.rpm	8502a60d7ca8ebb895cb8e36f63284c2610ad4d42f3463f3d21111b8704ecbce
x86_64	webkit2gtk3-jsc-devel-2.52.5-1.el8_10.x86_64.rpm	98e0f10a17edfa3ef04886e2d2e6fe0a6816ca5236386470549ce6e3a3058a9b

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What does ALSA-2026:42088 fix?

23 CVEs in webkitgtk:, including webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872).

Which release is covered?

AlmaLinux 8.

How do I apply it?

dnf update webkitgtk: — restart the service if it runs persistently.

References

Security Advisories

Related Advisories

Perl-CGI Security Update — AlmaLinux 8 (ALSA-2026:99849)

2026-11-12

.NET 8.0 Security Update — AlmaLinux 8 (ALSA-2026:99052)

2026-11-12

Grafana Security Update — AlmaLinux 8 (ALSA-2026:99030)

2026-11-12

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System