This advisory addresses multiple vulnerabilities in the webkit2gtk3 package for Red Hat Enterprise Linux 8.6, where processing malicious web content can lead to unexpected process crashes (including Safari), bypass Content Security Policy (CSP), or allow an app to access sensitive user data. Red Hat Product Security has rated the update's impact as Important, with detailed CVSS scores available via the linked CVE pages. The update is available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On.
Red Hat Product Errata RHSA-2026:28114 - Security Advisory Issued: 2026-06-23 Updated: 2026-06-23 RHSA-2026:28114 - Security Advisory Overview Updated Packages Synopsis Important: webkit2gtk3 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28946) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28847) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28883) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28901) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28902) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28903) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28904) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28905) webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-28907) webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28942) webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28947) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28953) webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28955) webkitgtk: An app may be able to access sensitive user data (CVE-2026-28958) webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43658) webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-43660) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.6 x86_64 Red Hat Enterprise Linux Server - AUS 8.6 x86_64 Fixes BZ - 2471790 - CVE-2026-28946 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash BZ - 2483955 - CVE-2026-28847 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483956 - CVE-2026-28883 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483957 - CVE-2026-28901 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483958 - CVE-2026-28902 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483959 - CVE-2026-28903 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483960 - CVE-2026-28904 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483961 - CVE-2026-28905 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483962 - CVE-2026-28907 webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced BZ - 2483963 - CVE-2026-28942 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash BZ - 2483964 - CVE-2026-28947 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash BZ - 2483965 - CVE-2026-28953 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483966 - CVE-2026-28955 webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash BZ - 2483967 - CVE-2026-28958 webkitgtk: An app may be able to access sensitive user data BZ - 2483968 - CVE-2026-43658 webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash BZ - 2483969 - CVE-2026-43660 webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced CVEs CVE-2026-28847 CVE-2026-28883 CVE-2026-28901 CVE-2026-28902 CVE-2026-28903 CVE-2026-28904 CVE-2026-28905 CVE-2026-28907 CVE-2026-28942 CVE-2026-28946 CVE-2026-28947 CVE-2026-28953 CVE-2026-28955 CVE-2026-28958 CVE-2026-43658 CVE-2026-43660 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.6 SRPM webkit2gtk3-2.52.4-1.el8_6.src.rpm SHA-256: 5c0c2f1807b748b1dfc7e27fa65c584bb878b4ea3d3a1702a2291a3a8f5958a8 x86_64 webkit2gtk3-2.52.4-1.el8_6.i686.rpm SHA-256: 9df6124587a8d9ddfb6f8bd0a9cf641ffbcae6b8c043817e166ada83e4a94bc4 webkit2gtk3-2.52.4-1.el8_6.x86_64.rpm SHA-256: cbba6b7c319d4972a3c3ab371c1b6cb30207e48e58ede5479cb2d717d3f08f5e webkit2gtk3-debuginfo-2.52.4-1.el8_6.i686.rpm SHA-256: 3da0e5cc5047fdad71817c6e0c3d52bc5a7a05e0dd016a51c9f0f25f83ffc2d8 webkit2gtk3-debuginfo-2.52.4-1.el8_6.x86_64.rpm SHA-256: 8f2996741366df7f02084028c8bda671dcd97e44355e02be2f8a54650ea35515 webkit2gtk3-debugsource-2.52.4-1.el8_6.i686.rpm SHA-256: 8726e5a694332274778fa1ba9ae09e757943db6cb25046e276e29733bc43b975 webkit2gtk3-debugsource-2.52.4-1.el8_6.x86_64.rpm SHA-256: 9dee6b220d08510c8c54a30bc8feaf33e91393b56d93574c4739adf84c314e20 webkit2gtk3-devel-2.52.4-1.el8_6.i686.rpm SHA-256: 2e42968b3d56a464a3c325055f67272214f13cb568c476d631ceba5b2dd1a9f2 webkit2gtk3-devel-2.52.4-1.el8_6.x86_64.rpm SHA-256: 678309ed4c24bcbd3c36cdc12853806f0c07b4c251083cbbba1bcd4d20837eba webkit2gtk3-devel-debuginfo-2.52.4-1.el8_6.i686.rpm SHA-256: 594aac0380c945d9d3d19601b093c1ec33bd32f5fc50e59f5bad7f9ae86246fd webkit2gtk3-devel-debuginfo-2.52.4-1.el8_6.x86_64.rpm SHA-256: 1fa2cdc9efa6b5153f1604c02ec45c36e5f8731098458fb064a33015c80c1044 webkit2gtk3-jsc-2.52.4-1.el8_6.i686.rpm SHA-256: a9af7045de0795ab4a09e3ddc29ad1ec202e3b9b3c8c58b133a2f3d2fe43f421 webkit2gtk3-jsc-2.52.4-1.el8_6.x86_64.rpm SHA-256: c9f8f0af97a926f9769f072cf3b847c2bd197181061b694e0c97027cca2be315 webkit2gtk3-jsc-debuginfo-2.52.4-1.el8_6.i686.rpm SHA-256: 43fc301471409adf5e95ca711e2b03a5cbf46a66b414a002bc8b81fa1d68e5cd webkit2gtk3-jsc-debuginfo-2.52.4-1.el8_6.x86_64.rpm SHA-256: 4501eae73b39c974dde5282d474d904bfb1a0dbff2b7c3557de173f55cc03827 webkit2gtk3-jsc-devel-2.52.4-1.el8_6.i686.rpm SHA-256: 044eb06dbb96910889d5d7c1d8441f08c40843ea04b3ce44056586f529770ea4 webkit2gtk3-jsc-devel-2.52.4-1.el8_6.x86_64.rpm SHA-256: 6a3051413b7ea799ac533439cd07bb23539b7e1e92ade7cf8413c1a6ceefad37 webkit2gtk3-jsc-devel-debuginfo-2.52.4-1.el8_6.i686.rpm SHA-256: c9e89f4b21d276996c4ac22c718183e69ee5f8d75127df66028e2dc074d7abac webkit2gtk3-jsc-devel-debuginfo-2.52.4-1.el8_6.x86_64.rpm SHA-256: 02ca6e4e3492f3d1c204b4e75030d4e462cbe4126c27a4c813e55ce142b45a4a Red Hat Enterprise Linux Server - AUS 8.6 SRPM webkit2gtk3-2.52.4-1.el8_6.src.rpm SHA-256: 5c0c2f1807b748b1dfc7e27fa65c584bb878b4ea3d3a1702a2291a3a8f5958a8 x86_64 webkit2gtk3-2.52.4-1.el8_6.i686.rpm SHA-256: 9df6124587a8d9ddfb6f8bd0a9cf641ffbcae6b8c043817e166ada83e4a94bc4 webkit2gtk3-2.52.4-1.el8_6.x86_64.rpm SHA-256: cbba6b7c319d4972a3c3ab371c1b6cb30207e48e58ede5479cb2d717d3f08f5e webkit2gtk3-debuginfo-2.52.4-1.el8_6.i686.rpm SHA-256: 3da0e5cc5047fdad71817c6e0c3d52bc5a7a05e0dd016a51c9f0f25f83ffc2d8 webkit2gtk3-debuginfo-2.52.4-1.el8_6.x86_64.rpm SHA-256: 8f2996741366df7f02084028c8bda671dcd97e44355e02be2f8a54650ea35515 webkit2gtk3-debugsource-2.52.4-1.el8_6.i686.rpm SHA-256: 8726e5a694332274778fa1ba9ae09e757943db6cb25046e276e29733bc43b975 webkit2gtk3-debugsource-2.52.4-1.el8_6.x86_64.rpm SHA-256: 9dee6b220d08510c8c54a30bc8feaf33e91393b56d93574c4739adf84c314e20 webkit2gtk3-devel-2.52.4-1.el8_6.i686.rpm SHA-256: 2e42968b3d56a464a3c325055f67272214f13cb568c476d631ceba5b2dd1a9f2 webkit2gtk3-devel-2.52.4-1.el8_6.x86_64.rpm SHA-256: 678309ed4c24bcbd3c36cdc12853806f0c07b4c251083cbbba1bcd4d20837eba webkit2gtk3-devel-debuginfo-2.52.4-1.el8_6.i686.rpm SHA-256: 594aac0380c945d9d3d19601b093c1ec33bd32f5fc50e59f5bad7f9ae86246fd webkit2gtk3-devel-debuginfo-2.52.4-1.el8_6.x86_64.rpm SHA-256: 1fa2cdc9efa6b5153f1604c02ec45c36e5f8731098458fb064a33015c80c1044 webkit2gtk3-jsc-2.52.4-1.el8_6.i686.rpm SHA-256: a9af7045de0795ab4a09e3ddc29ad1ec202e3b9b3c8c58b133a2f3d2fe43f421 webkit2gtk3-jsc-2.52.4-1.el8_6.x86_64.rpm SHA-256: c9f8f0af97a926f9769f072cf3b847c2bd197181061b694e0c97027cca2be315 webkit2gtk3-jsc-debuginfo-2.52.4-1.el8_6.i686.rpm SHA-256: 43fc301471409adf5e95ca711e2b03a5cbf46a66b414a002bc8b81fa1d68e5cd webkit2gtk3-jsc-debuginfo-2.52.4-1.el8_6.x86_64.rpm SHA-256: 4501eae73b39c974dde5282d474d904bfb1a0dbff2b7c3557de173f55cc03827 webkit2gtk3-jsc-devel-2.52.4-1.el8_6.i686.rpm SHA-256: 044eb06dbb96910889d5d7c1d8441f08c40843ea04b3ce44056586f529770ea4 webkit2gtk3-jsc-devel-2.52.4-1.el8