RHSA-2026:22136 — Security Advisory

Red Hat Security Advisory: webkitgtk4 security update

Loading…

Severity

Important

Red Hat Product Security

RHEL 7

Products

Official CSAF product identity

Published · June 1, 2026

Updated · July 15, 2026

Topic

An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK+ is port of the WebKit portable web rendering engine to the GTK+ platform. These packages provide WebKitGTK+ for GTK+ 3.

Security Fix(es):

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)
webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)
webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)
webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)
webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)
webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)
webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)
webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.