RHSA-2026:96080HighCVSS 9.6

Red Hat Security Advisory: webkit2gtk3 security update

Published
November 9, 2026
Last Modified
November 9, 2026

🔗 CVE IDs covered (18)

CVE-2026-102325 →CVE-2026-106379 →CVE-2026-118319 →CVE-2026-85049 →CVE-2026-93387 →CVE-2026-103629 →CVE-2026-118348 →CVE-2026-91740 →CVE-2026-113106 →CVE-2026-118340 →CVE-2026-119261 →CVE-2026-119271 →CVE-2026-84359 →CVE-2026-106399 →CVE-2026-118351 →CVE-2026-118354 →CVE-2026-91733 →CVE-2026-91747 →

📋 Description

CVE-2026-84359 — chromium-browser: skia: chromium-browser: Information leak in Skia CVE-2026-85049 — chromium-browser: skia: chromium-browser: skia: Use after free in Skia CVE-2026-91733 — chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation CVE-2026-91740 — chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia CVE-2026-91747 — chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability CVE-2026-93387 — chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation CVE-2026-102325 — chromium-browser: skia: chromium-browser: Uninitialized resource in Skia CVE-2026-103629 — chromium-browser: skia: Integer overflow in Skia CVE-2026-106379 — chromium-browser: skia: Uninitialized resource in Skia CVE-2026-106399 — chromium-browser: skia: Out of bounds read in Skia CVE-2026-113106 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118319 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118340 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118348 — chromium-browser: skia: Improper input validation in Skia CVE-2026-118351 — chromium-browser: skia: Memory corruption in Skia CVE-2026-118354 — chromium-browser: skia: Improper input validation in Skia CVE-2026-119261 — chromium-browser: skia: Buffer overflow in Skia CVE-2026-119271 — chromium-browser: skia: Uninitialized resource in Skia

🎯 Affected products47

  • Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.54.2-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.54.2-2.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.54.2-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.54.2-2.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.54.2-2.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-0:2.54.2-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debuginfo-0:2.54.2-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.54.2-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.54.2-2.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.54.2-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.54.2-2.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-debugsource-0:2.54.2-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.54.2-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.54.2-2.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.54.2-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.54.2-2.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-0:2.54.2-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-devel-debuginfo-0:2.54.2-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-jsc-0:2.54.2-2.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-jsc-0:2.54.2-2.el8_10.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • webkit2gtk3-jsc-0:2.54.2-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +17 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to isolate browser renderer processes and prevent execution of untrusted graphics rendering workloads through unpatched Skia libraries: upgrade to Google Chrome 156.0.8078.73 (or the corresponding fixed Red Hat builds), which resolves memory corruption within the Skia component to eliminate out-of-bounds memory access inside the browser sandbox, closing crafted HTML page. Until patched, this is a concern on Chromium and Webkitgtk browser environments processing untrusted web content, so restrict user access to untrusted web content and enforce strict network filtering against external, untrusted web destinations. As a compensating measure, Enable ASLR to randomize renderer process memory layout and hinder reliable pointer calculations, Enforce non-executable page permissions (NX/XD bit) to block shellcode execution in data memory, Enforce full RELRO and PIE in browser binaries to prevent Global Offset Table overwrite, Enable Control Flow Integrity and Shadow Call Stack to validate indirect call targets and return addresses, Enable Arbitrary Code Guard on Windows to block dynamic allocation of executable memory pages, and Deploy EDR agents to monitor and detect anomalous post-exploitation behaviors or shell spawning from browser renderers. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium) Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce Control Flow Integrity and Shadow Call Stack to validate indirect call targets and block control-flow hijacking from memory corruption in Skia: upgrade to Google Chrome 156.0.8078.73 (or the corresponding fixed Red Hat builds), which resolves memory corruption within the Skia 2D graphics rendering engine, closing crafted HTML page. Until patched, this is a concern on users navigating to attacker-controlled or malicious websites on any platform using affected browsers, so restrict user navigation to trusted websites and prevent opening untrusted HTML pages or untrusted links in affected browser environments. As a compensating measure, randomize userspace process memory layouts via ASLR to impede deterministic code execution and ROP gadget chaining, enforce non-executable memory via NX/XD bit to block code execution from writable heap and stack pages, enable full RELRO and PIE to protect Global Offset Tables from overwrites and support complete address randomization, compile binaries with FORTIFY_SOURCE to terminate processes upon detecting runtime buffer overflows in standard library calls, apply kernel-level seccomp syscall filtering to restrict system calls and prevent sandbox escapes, and deploy endpoint detection and response monitoring to detect anomalous process spawning and post-exploitation execution. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-113 Control Flow Integrity (CFI / Shadow Call Stack) (high) Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce strict input validation on drawing primitives and rendered web content processed by the Skia graphics engine: upgrade to Google Chrome 156.0.8078.73+ (or the corresponding fixed Red Hat builds), which validates input in the Skia component to prevent sandbox code execution during web content rendering, closing crafted HTML page. Until patched, this is a concern on all platforms running Chromium or WebKitGTK rendering untrusted web content, so restrict browsing to trusted sites and avoid loading untrusted or attacker-controlled web content. As a compensating measure, validate image dimensions, path counts, and buffer sizes before memory allocation and rendering bounds operations in Skia, enable ASLR to randomize the browser renderer process address space and hinder reliable code execution, and enforce non-executable page permissions on renderer heap and stack allocations using NX/XD bit. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper input validation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (medium) Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to eliminate memory corruption in Skia graphics rendering routines processing untrusted web content: upgrade to Google Chrome 156.0.8078.73+ (or the corresponding fixed Red Hat builds), which fixes memory corruption in the Skia graphics component when rendering crafted web content, closing crafted HTML page. Until patched, this is a concern on Chromium and WebKitGTK browser users rendering untrusted HTML pages, so restrict user browsing to trusted sites and avoid opening untrusted or attacker-controlled HTML pages. As a compensating measure, enable Full RELRO and PIE to make the Global Offset Table read-only and randomize binary base addresses, enforce kernel-level syscall filtering via seccomp to restrict available system calls in the renderer sandbox, enable Arbitrary Code Guard on Windows to block allocation and execution of dynamic code pages, deploy EDR agents to monitor and detect anomalous child process spawning or payload execution from the browser renderer, and compile with stack canaries to abort execution on stack buffer overflows. These controls limit blast radius and contain exploitation, but they do not fix the underlying memory corruption flaw — apply the upstream patch to fully remediate. Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (high) Workaround: --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently e…

🔗 References (21)