Вернуться к предупреждениям о безопасности

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:91636)

ALSA-2026:91636 updates WebKitGTK on AlmaLinux 8, fixing six vulnerabilities (CVE-2026-95325, CVE-2026-95331, CVE-2026-106304, CVE-2026-106247, CVE-2026-106293, CVE-2026-106245) — use-after-free and out-of-bounds write flaws (CWE-416) in the ANGLE graphics layer, aggregate CVSS 9.6 Critical. Update with dnf update webkit2gtk3 and restart applications that embed the WebKit view.

Critical 9.6 CVSS
AlmaLinux 8

Что это значит по лицензии SharedLicense

Use-after-free and out-of-bounds writes in the graphics layer are the classic browser-escape pair: crafted web content can crash the renderer and potentially chain to code execution inside any application embedding WebKitGTK.

Type:

security

Severity:

important

Release date:

2026-10-28

Description:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325)
* chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331)
* chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304)
* chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247)
* chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293)
* chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 webkit2gtk3-jsc-devel-2.54.2-1.el8_10.aarch64.rpm 3eb4b6eb2054683be009ce11f0ee0a10eff30b749c328c17bf41ee3037af692e
aarch64 webkit2gtk3-devel-2.54.2-1.el8_10.aarch64.rpm 4024f0ebf9875ad8f6f3b802714fe8be56825cd3b5a9de2b2a0dde54889989fd
aarch64 webkit2gtk3-2.54.2-1.el8_10.aarch64.rpm 778420d47bb1c417f72e73dbe36918cb2723d8da277650fb555300a4995df929
aarch64 webkit2gtk3-jsc-2.54.2-1.el8_10.aarch64.rpm e0a125fe3ed7a640683b82a0614ddc21c67a9b553f48269ac2a5d1651d8a5b53
i686 webkit2gtk3-jsc-2.54.2-1.el8_10.i686.rpm 066fd2b1c38ce5a879d5a7ed31099d84ecaf2f495f2a777c6e8abf6c08e1330f
i686 webkit2gtk3-2.54.2-1.el8_10.i686.rpm 5076a46881cdcaf799ad442c6f2256f5fee78ebf30380d3312ec62b61b3fdbe8
i686 webkit2gtk3-devel-2.54.2-1.el8_10.i686.rpm 8b9093b9a7c864cdc8fdd34ad146157db74143797bc0e99afc829ed6ce19d7ef
i686 webkit2gtk3-jsc-devel-2.54.2-1.el8_10.i686.rpm 925d474ba02928f89e780b1f437781bd885ebe336928de3b5c9f9fe77497ca8f
ppc64le webkit2gtk3-2.54.2-1.el8_10.ppc64le.rpm 7b0ac20e562c43666f5aca62909dcbde187e8d2ada51f3d070a807e074658a25
ppc64le webkit2gtk3-devel-2.54.2-1.el8_10.ppc64le.rpm 8b46499a4916ca4626f18f2fc8887d19da3a78e965b4fdfcf6394989a507617e
ppc64le webkit2gtk3-jsc-devel-2.54.2-1.el8_10.ppc64le.rpm a0ba1e0b73a917db762cde40d7a3e5c9876b01fc554e21e4749d41bd7db198ed
ppc64le webkit2gtk3-jsc-2.54.2-1.el8_10.ppc64le.rpm fbd636705494fe4119e92f93a50be9681c98d10010a53b222b45f48cbe3fdb0a
s390x webkit2gtk3-jsc-devel-2.54.2-1.el8_10.s390x.rpm 5747181df87492ac8788850b4288d67539d5e7317d9fa07f19b91edea675bfcd
s390x webkit2gtk3-jsc-2.54.2-1.el8_10.s390x.rpm 683ad48fbb1ad3cb0ddb6a0c908d1ed431133e4a70fae2d96500f18266e2ecb9
s390x webkit2gtk3-2.54.2-1.el8_10.s390x.rpm be241ba40df179f5b4d307accb11a971ec33269e89514f5ebcba3ec6bf498e35
s390x webkit2gtk3-devel-2.54.2-1.el8_10.s390x.rpm c537f4b8aa8f72ada40b61912f39c851313419b6808dedd84de304ff57ea8827
x86_64 webkit2gtk3-jsc-2.54.2-1.el8_10.x86_64.rpm 03f288df127a6332c0058edc94366c696131f7e3f887906f81e3fde0e71848a0
x86_64 webkit2gtk3-devel-2.54.2-1.el8_10.x86_64.rpm 7957c17788a8b1ff0677618160a09354353c60821793491b4161a0d971678e39
x86_64 webkit2gtk3-2.54.2-1.el8_10.x86_64.rpm a605123523f1252f6d4dda7addb21664bb2b76fc340f0c04ebe2dddaf6a3956b
x86_64 webkit2gtk3-jsc-devel-2.54.2-1.el8_10.x86_64.rpm befd4ecf5cc1f0d43dee25ccabd22bf5f446cb9e7185e31d1962387c06b413d6

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is ALSA-2026:91636?
It is AlmaLinux's WebKitGTK erratum for AlmaLinux 8, fixing six CVEs — CVE-2026-95325 (use after free in ANGLE), CVE-2026-95331 (out-of-bounds write in ANGLE), CVE-2026-106304, CVE-2026-106247, CVE-2026-106293 and CVE-2026-106245 — at aggregate CVSS 9.6, Critical.
Who is affected?
AlmaLinux 8 systems running applications that embed WebKitGTK — mail clients, mini-browsers and document viewers. Headless servers without WebKitGTK are unaffected.
How do I apply the fix?
Run dnf update webkit2gtk3 and restart any applications using the WebKit view so they reload the patched engine.
What is ANGLE and why does it matter here?
ANGLE is the graphics translation layer WebKit uses for GPU rendering — use-after-free and out-of-bounds write flaws there are triggered by crafted web graphics content and are among the most exploited browser flaw classes.

Источники

Предупреждения о безопасности

Похожие предупреждения

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему