Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceRHSA-2026:13845

RHSA-2026:13845

HIGH8.8

Red Hat Security Advisory: webkit2gtk3 security update

Published May 5, 2026

Modified 5 days ago

Fix available

Details

Details:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)
webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)
webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)
webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)
webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)
webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)
webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)
webkitgtk: A malicious website may be able to process restricted web content outside the sandbox...

Affected Packages

webkit2gtk3

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-debuginfo

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-debugsource

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-devel

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-devel-debuginfo

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-jsc

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-jsc-debuginfo

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-jsc-devel

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

webkit2gtk3-jsc-devel-debuginfo

Red Hat rhel_aus 8.6 appstreamRed Hat rhel_e4s 8.6 appstreamRed Hat rhel_tus 8.6 appstream

Fixed in:

0:2.52.3-1.el8_6

References

https://access.redhat.com/errata/RHSA-2026:13845

https://access.redhat.com/security/updates/classification/#important

https://bugzilla.redhat.com/show_bug.cgi?id=2448781

https://bugzilla.redhat.com/show_bug.cgi?id=2448782

https://bugzilla.redhat.com/show_bug.cgi?id=2448786

https://bugzilla.redhat.com/show_bug.cgi?id=2448787

https://bugzilla.redhat.com/show_bug.cgi?id=2448788

https://bugzilla.redhat.com/show_bug.cgi?id=2448789

https://bugzilla.redhat.com/show_bug.cgi?id=2448790

https://bugzilla.redhat.com/show_bug.cgi?id=2448791

https://bugzilla.redhat.com/show_bug.cgi?id=2448792

https://bugzilla.redhat.com/show_bug.cgi?id=2448793

https://bugzilla.redhat.com/show_bug.cgi?id=2448794

https://bugzilla.redhat.com/show_bug.cgi?id=2453000

https://bugzilla.redhat.com/show_bug.cgi?id=2453001

https://bugzilla.redhat.com/show_bug.cgi?id=2453002

https://bugzilla.redhat.com/show_bug.cgi?id=2453003

https://bugzilla.redhat.com/show_bug.cgi?id=2453004

https://bugzilla.redhat.com/show_bug.cgi?id=2453006

https://bugzilla.redhat.com/show_bug.cgi?id=2453008

https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13845.json

CVSS Analysis

CVSS v3.1

8.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Upstream

CVE-2025-43213 CVE-2025-43214 CVE-2025-43457 CVE-2025-43511 CVE-2025-46299 CVE-2026-20608 CVE-2026-20635 CVE-2026-20636 CVE-2026-20643 CVE-2026-20644 CVE-2026-20652 CVE-2026-20664 CVE-2026-20665 CVE-2026-20676 CVE-2026-20691 CVE-2026-28857 CVE-2026-28859 CVE-2026-28871

Ecosystems

Red Hat rhel_aus 8.6 appstream Red Hat rhel_e4s 8.6 appstream Red Hat rhel_tus 8.6 appstream

Timeline

PublishedMay 5, 2026

ModifiedMay 20, 2026

RHSA-2026:13845 | Mondoo Vulnerability Intelligence