Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

RLSA-2026:42088 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceRLSA-2026:42088

RLSA-2026:42088

HIGH8.8

Important: webkit2gtk3 security update

Published Jul 21, 2026

Modified 1 months ago

Fix available

Details

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699)
webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701)
webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712)
webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713)
webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720)
webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721)
webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43725)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43726)
webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43727)
webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731)

*...

Affected Packages

webkit2gtk3

Rocky Linux 8

Fixed in:

0:2.52.5-1.el8_10

References

https://bugzilla.redhat.com/show_bug.cgi?id=2280382

https://bugzilla.redhat.com/show_bug.cgi?id=2500519

https://bugzilla.redhat.com/show_bug.cgi?id=2500520

https://bugzilla.redhat.com/show_bug.cgi?id=2500521

https://bugzilla.redhat.com/show_bug.cgi?id=2500522

https://bugzilla.redhat.com/show_bug.cgi?id=2500523

https://bugzilla.redhat.com/show_bug.cgi?id=2500524

https://bugzilla.redhat.com/show_bug.cgi?id=2500525

https://bugzilla.redhat.com/show_bug.cgi?id=2500526

https://bugzilla.redhat.com/show_bug.cgi?id=2500527

https://bugzilla.redhat.com/show_bug.cgi?id=2500528

https://bugzilla.redhat.com/show_bug.cgi?id=2500529

https://bugzilla.redhat.com/show_bug.cgi?id=2500530

https://bugzilla.redhat.com/show_bug.cgi?id=2500531

https://bugzilla.redhat.com/show_bug.cgi?id=2500532

https://bugzilla.redhat.com/show_bug.cgi?id=2500533

https://bugzilla.redhat.com/show_bug.cgi?id=2500534

https://bugzilla.redhat.com/show_bug.cgi?id=2500535

https://bugzilla.redhat.com/show_bug.cgi?id=2500536

https://bugzilla.redhat.com/show_bug.cgi?id=2500537

https://bugzilla.redhat.com/show_bug.cgi?id=2500538

https://bugzilla.redhat.com/show_bug.cgi?id=2500539

https://bugzilla.redhat.com/show_bug.cgi?id=2500540

https://errata.rockylinux.org/RLSA-2026:42088

CVSS Analysis

CVSS v3.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Upstream

CVE-2024-4367 CVE-2026-39872 CVE-2026-43663 CVE-2026-43676 CVE-2026-43699 CVE-2026-43701 CVE-2026-43705 CVE-2026-43707 CVE-2026-43712 CVE-2026-43713 CVE-2026-43715 CVE-2026-43716 CVE-2026-43720 CVE-2026-43721 CVE-2026-43725 CVE-2026-43726 CVE-2026-43727 CVE-2026-43731 CVE-2026-43732 CVE-2026-43734 CVE-2026-43740 CVE-2026-43742 CVE-2026-43745

Ecosystems

Credits

Rocky Enterprise Software Foundation

Red Hat

Timeline

PublishedJul 21, 2026

ModifiedJul 27, 2026