Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:91636)

ALSA-2026:91636 updates WebKitGTK on AlmaLinux 8, fixing six vulnerabilities (CVE-2026-95325, CVE-2026-95331, CVE-2026-106304, CVE-2026-106247, CVE-2026-106293, CVE-2026-106245) — use-after-free and out-of-bounds write flaws (CWE-416) in the ANGLE graphics layer, aggregate CVSS 9.6 Critical. Update with dnf update webkit2gtk3 and restart applications that embed the WebKit view.

Critical 9.6 CVSS 2026-10-28

AlmaLinux 8

SharedLicense लाइसेंस के तहत इसका अर्थ

Use-after-free and out-of-bounds writes in the graphics layer are the classic browser-escape pair: crafted web content can crash the renderer and potentially chain to code execution inside any application embedding WebKitGTK.

Type:

security

Severity:

important

Release date:

2026-10-28

Description:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325)
* chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331)
* chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304)
* chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247)
* chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293)
* chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	webkit2gtk3-jsc-devel-2.54.2-1.el8_10.aarch64.rpm	3eb4b6eb2054683be009ce11f0ee0a10eff30b749c328c17bf41ee3037af692e
aarch64	webkit2gtk3-devel-2.54.2-1.el8_10.aarch64.rpm	4024f0ebf9875ad8f6f3b802714fe8be56825cd3b5a9de2b2a0dde54889989fd
aarch64	webkit2gtk3-2.54.2-1.el8_10.aarch64.rpm	778420d47bb1c417f72e73dbe36918cb2723d8da277650fb555300a4995df929
aarch64	webkit2gtk3-jsc-2.54.2-1.el8_10.aarch64.rpm	e0a125fe3ed7a640683b82a0614ddc21c67a9b553f48269ac2a5d1651d8a5b53
i686	webkit2gtk3-jsc-2.54.2-1.el8_10.i686.rpm	066fd2b1c38ce5a879d5a7ed31099d84ecaf2f495f2a777c6e8abf6c08e1330f
i686	webkit2gtk3-2.54.2-1.el8_10.i686.rpm	5076a46881cdcaf799ad442c6f2256f5fee78ebf30380d3312ec62b61b3fdbe8
i686	webkit2gtk3-devel-2.54.2-1.el8_10.i686.rpm	8b9093b9a7c864cdc8fdd34ad146157db74143797bc0e99afc829ed6ce19d7ef
i686	webkit2gtk3-jsc-devel-2.54.2-1.el8_10.i686.rpm	925d474ba02928f89e780b1f437781bd885ebe336928de3b5c9f9fe77497ca8f
ppc64le	webkit2gtk3-2.54.2-1.el8_10.ppc64le.rpm	7b0ac20e562c43666f5aca62909dcbde187e8d2ada51f3d070a807e074658a25
ppc64le	webkit2gtk3-devel-2.54.2-1.el8_10.ppc64le.rpm	8b46499a4916ca4626f18f2fc8887d19da3a78e965b4fdfcf6394989a507617e
ppc64le	webkit2gtk3-jsc-devel-2.54.2-1.el8_10.ppc64le.rpm	a0ba1e0b73a917db762cde40d7a3e5c9876b01fc554e21e4749d41bd7db198ed
ppc64le	webkit2gtk3-jsc-2.54.2-1.el8_10.ppc64le.rpm	fbd636705494fe4119e92f93a50be9681c98d10010a53b222b45f48cbe3fdb0a
s390x	webkit2gtk3-jsc-devel-2.54.2-1.el8_10.s390x.rpm	5747181df87492ac8788850b4288d67539d5e7317d9fa07f19b91edea675bfcd
s390x	webkit2gtk3-jsc-2.54.2-1.el8_10.s390x.rpm	683ad48fbb1ad3cb0ddb6a0c908d1ed431133e4a70fae2d96500f18266e2ecb9
s390x	webkit2gtk3-2.54.2-1.el8_10.s390x.rpm	be241ba40df179f5b4d307accb11a971ec33269e89514f5ebcba3ec6bf498e35
s390x	webkit2gtk3-devel-2.54.2-1.el8_10.s390x.rpm	c537f4b8aa8f72ada40b61912f39c851313419b6808dedd84de304ff57ea8827
x86_64	webkit2gtk3-jsc-2.54.2-1.el8_10.x86_64.rpm	03f288df127a6332c0058edc94366c696131f7e3f887906f81e3fde0e71848a0
x86_64	webkit2gtk3-devel-2.54.2-1.el8_10.x86_64.rpm	7957c17788a8b1ff0677618160a09354353c60821793491b4161a0d971678e39
x86_64	webkit2gtk3-2.54.2-1.el8_10.x86_64.rpm	a605123523f1252f6d4dda7addb21664bb2b76fc340f0c04ebe2dddaf6a3956b
x86_64	webkit2gtk3-jsc-devel-2.54.2-1.el8_10.x86_64.rpm	befd4ecf5cc1f0d43dee25ccabd22bf5f446cb9e7185e31d1962387c06b413d6

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

अक्सर पूछे जाने वाले प्रश्न

What is ALSA-2026:91636?

It is AlmaLinux's WebKitGTK erratum for AlmaLinux 8, fixing six CVEs — CVE-2026-95325 (use after free in ANGLE), CVE-2026-95331 (out-of-bounds write in ANGLE), CVE-2026-106304, CVE-2026-106247, CVE-2026-106293 and CVE-2026-106245 — at aggregate CVSS 9.6, Critical.

Who is affected?

AlmaLinux 8 systems running applications that embed WebKitGTK — mail clients, mini-browsers and document viewers. Headless servers without WebKitGTK are unaffected.

How do I apply the fix?

Run dnf update webkit2gtk3 and restart any applications using the WebKit view so they reload the patched engine.

What is ANGLE and why does it matter here?

ANGLE is the graphics translation layer WebKit uses for GPU rendering — use-after-free and out-of-bounds write flaws there are triggered by crafted web graphics content and are among the most exploited browser flaw classes.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें

अक्सर पूछे जाने वाले प्रश्न

संबंधित सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें