Red Hat Product Errata RHSA-2026:99132 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:99132 - Security Advisory

Synopsis

Important: webkit2gtk3 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121084)
  • chromium-browser: angle: Use after free in ANGLE (CVE-2026-121148)
  • chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-121197)
  • chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-121249)
  • chromium-browser: skia: Buffer overflow in Skia (CVE-2026-121086)
  • chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121160)
  • chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-121072)
  • chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-121227)
  • chromium-browser: skia: Out of bounds read in Skia (CVE-2026-121032)
  • chromium-browser: angle: Race condition in ANGLE (CVE-2026-121230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2566301 - CVE-2026-121084 chromium-browser: skia: Out of bounds read in Skia
  • BZ - 2566326 - CVE-2026-121148 chromium-browser: angle: Use after free in ANGLE
  • BZ - 2566349 - CVE-2026-121197 chromium-browser: angle: Out of bounds read in ANGLE
  • BZ - 2566371 - CVE-2026-121249 chromium-browser: angle: Buffer overflow in ANGLE
  • BZ - 2566373 - CVE-2026-121086 chromium-browser: skia: Buffer overflow in Skia
  • BZ - 2566387 - CVE-2026-121160 chromium-browser: skia: Out of bounds read in Skia
  • BZ - 2566441 - CVE-2026-121072 chromium-browser: skia: Uninitialized resource in Skia
  • BZ - 2566476 - CVE-2026-121227 chromium-browser: skia: Uninitialized resource in Skia
  • BZ - 2566482 - CVE-2026-121032 chromium-browser: skia: Out of bounds read in Skia
  • BZ - 2566492 - CVE-2026-121230 chromium-browser: angle: Race condition in ANGLE

Red Hat Enterprise Linux for x86_64 9

SRPM
webkit2gtk3-2.54.2-3.el9_9.src.rpm SHA-256: b06a50cd1a986ef06c606b06071b3b360f932c657353f7b3e504af955e349f0b
x86_64
webkit2gtk3-2.54.2-3.el9_9.i686.rpm SHA-256: ba862ad893c70b7eff395a1668cbf6680ed5d0cb218460e008a9257830b8f260
webkit2gtk3-2.54.2-3.el9_9.x86_64.rpm SHA-256: 0d53c3ffa57d19a5767cd0acbdf2276a95bf21dfedabf4fd1fe7a723e891c954
webkit2gtk3-debuginfo-2.54.2-3.el9_9.i686.rpm SHA-256: a47877ecee133e8b3ec6fa17267a6c08bb9fbe0ce174ad535805d34830f5bc9a
webkit2gtk3-debuginfo-2.54.2-3.el9_9.x86_64.rpm SHA-256: 30bb202050fc5c500c014b06d5eeada13642ca91153fb7d0df530d66137cbed1
webkit2gtk3-debugsource-2.54.2-3.el9_9.i686.rpm SHA-256: e98fb803deeaaafab0a2422fca6728c46c9c674d2bd3feeb504027a1fcdc71f0
webkit2gtk3-debugsource-2.54.2-3.el9_9.x86_64.rpm SHA-256: a5609e15ed326683a90f2255aa20655ad09d088d56da3afd262689e83b8784ed
webkit2gtk3-devel-2.54.2-3.el9_9.i686.rpm SHA-256: a2369a89537d467e17ece6902813ffc7869b5d45b5b8608e7dc7a962250a1a87
webkit2gtk3-devel-2.54.2-3.el9_9.x86_64.rpm SHA-256: 8917e21b8e9c252feb71ebadb987f3444e7ecbeebaeb7edf35dc7fbded5dafa0
webkit2gtk3-devel-debuginfo-2.54.2-3.el9_9.i686.rpm SHA-256: 6d2f5f518c55ff3f06b63da03fe52c76127754a94073fac9584d423233515e9c
webkit2gtk3-devel-debuginfo-2.54.2-3.el9_9.x86_64.rpm SHA-256: d7492d878d2a16d86afd44269687017796b2012a37ad694cbbad344b496ffda4
webkit2gtk3-jsc-2.54.2-3.el9_9.i686.rpm SHA-256: 63eab40b29aaab3dd911159c21bb1d120a6a4dc9ea1b4301c82a995b6f63f75f
webkit2gtk3-jsc-2.54.2-3.el9_9.x86_64.rpm SHA-256: 5ef3669d9c15bab69c20874128a7c41c25b24b7e2a5063623cf3519229f4d2f9
webkit2gtk3-jsc-debuginfo-2.54.2-3.el9_9.i686.rpm SHA-256: 9f07f8add19a39f4e18075da3f46e431acd46080c4bcb06c860650eadfc6cf4b
webkit2gtk3-jsc-debuginfo-2.54.2-3.el9_9.x86_64.rpm SHA-256: 6f7d5a70e84b99febc24ba23360b4f9739388c50c83e1eb1c43184b5a1e5e24e
webkit2gtk3-jsc-devel-2.54.2-3.el9_9.i686.rpm SHA-256: c944802f23108dc62524b0d4910e9ae4e52b066d5ef5b1fc72677132f8d574a3
webkit2gtk3-jsc-devel-2.54.2-3.el9_9.x86_64.rpm SHA-256: 30e234c91af6717f989afca0a21a6d0e7b180237e34c0166dd3224395a4aef79
webkit2gtk3-jsc-devel-debuginfo-2.54.2-3.el9_9.i686.rpm SHA-256: 8096463d86b029b1509b9d6c50c3b99a2476bc1457080cc1cf67fc1ff83e7f00
webkit2gtk3-jsc-devel-debuginfo-2.54.2-3.el9_9.x86_64.rpm SHA-256: ae6b19f97da667b17a352ffa97d727bfe94b7e95dfbbefc3ad18a5876a46d8d7

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
webkit2gtk3-2.54.2-3.el9_9.src.rpm SHA-256: b06a50cd1a986ef06c606b06071b3b360f932c657353f7b3e504af955e349f0b
s390x
webkit2gtk3-2.54.2-3.el9_9.s390x.rpm SHA-256: b8cb5e58c355fa5b8c377dac3972fb33affe3071293ed076c85048576247bfb4
webkit2gtk3-debuginfo-2.54.2-3.el9_9.s390x.rpm SHA-256: 0dda8350065ba6a75977f8b90a4af9fbb49a19745ea9f2b2788f036e122418c5
webkit2gtk3-debugsource-2.54.2-3.el9_9.s390x.rpm SHA-256: 1d392a4ad1bdaa55ae87809b2bf4eb9e8855e20324bf61b28256096cb3e5b4fd
webkit2gtk3-devel-2.54.2-3.el9_9.s390x.rpm SHA-256: 62f3ab7ae1fe1659fd561d767e114bc9c512f943a04993cbe603edebe76b1a32
webkit2gtk3-devel-debuginfo-2.54.2-3.el9_9.s390x.rpm SHA-256: 59ee0b00122423c5ae2df4489a7872de6fe09846d58433a7f600b090a122cffa
webkit2gtk3-jsc-2.54.2-3.el9_9.s390x.rpm SHA-256: e6b8757098bc92a10b807ff2c990139b95c6a55e83913e01767afa45e7f6e951
webkit2gtk3-jsc-debuginfo-2.54.2-3.el9_9.s390x.rpm SHA-256: a77510e7e5cd59e9c92ba8df88f424517f30bfe6a8d6f1e791f017aebe9a4a00
webkit2gtk3-jsc-devel-2.54.2-3.el9_9.s390x.rpm SHA-256: bee998bbc890f67a2bb24f1572eb0554783b11fcdb466e997a4bb8c38f9ac0ca
webkit2gtk3-jsc-devel-debuginfo-2.54.2-3.el9_9.s390x.rpm SHA-256: e105f765b38a96ee22200f9fe606cbfe2321aebe41b7b65304d173e3d0cc2178

Red Hat Enterprise Linux for Power, little endian 9

SRPM
webkit2gtk3-2.54.2-3.el9_9.src.rpm SHA-256: b06a50cd1a986ef06c606b06071b3b360f932c657353f7b3e504af955e349f0b
ppc64le
webkit2gtk3-2.54.2-3.el9_9.ppc64le.rpm SHA-256: 1809874800793022cec092f929289895e4cac088fedb4041936d9981597e4b83
webkit2gtk3-debuginfo-2.54.2-3.el9_9.ppc64le.rpm SHA-256: 2290e5d74323ffdc25e894c68ed51f07e676a5feab46eac12e3bdb7b1f891460
webkit2gtk3-debugsource-2.54.2-3.el9_9.ppc64le.rpm SHA-256: f704de93745e467766baebbce9ec15ad660fa28a2fe46783d29201004c2d2b09
webkit2gtk3-devel-2.54.2-3.el9_9.ppc64le.rpm SHA-256: 396f560139311bb94fc84ae6df233b42f94bacf502c8cbf2fe64e2e9ee722d82
webkit2gtk3-devel-debuginfo-2.54.2-3.el9_9.ppc64le.rpm SHA-256: d406af3d85bf9433f1bb38d171a1eaedcd6a7766628f8df7b74c07d9f4d9fe5c
webkit2gtk3-jsc-2.54.2-3.el9_9.ppc64le.rpm SHA-256: 17662ca2523593e64b6be2c5901296fbebb673310aae31ff1dbfb77b9098134f
webkit2gtk3-jsc-debuginfo-2.54.2-3.el9_9.ppc64le.rpm SHA-256: 265afe62af787a990f1e7667cf758247926b2874751da444d207b876efda4c56
webkit2gtk3-jsc-devel-2.54.2-3.el9_9.ppc64le.rpm SHA-256: 78759c1e6422d4f973caf6fc8f1ec863c2e356354dcf962d4f9e37073212f14b
webkit2gtk3-jsc-devel-debuginfo-2.54.2-3.el9_9.ppc64le.rpm SHA-256: 426ac0d4f900e01df7b12663cb7154ca3c752e7a83d202f3ea999c06fd2c6638

Red Hat Enterprise Linux for ARM 64 9

SRPM
webkit2gtk3-2.54.2-3.el9_9.src.rpm SHA-256: b06a50cd1a986ef06c606b06071b3b360f932c657353f7b3e504af955e349f0b
aarch64
webkit2gtk3-2.54.2-3.el9_9.aarch64.rpm SHA-256: 07b5e116ec1d8fce98497a87e477a14a4298582bbbff9f2fe03f2399320a3564
webkit2gtk3-debuginfo-2.54.2-3.el9_9.aarch64.rpm SHA-256: 5e0d8c29c1d5f0f196e224d9b3cf26d80794f58949c82433da808ec762750faf
webkit2gtk3-debugsource-2.54.2-3.el9_9.aarch64.rpm SHA-256: 63041b466afaacbefe35312b23c5a986e73566e706bd4a234fc85f6775eb7ff9
webkit2gtk3-devel-2.54.2-3.el9_9.aarch64.rpm SHA-256: d250a05515ced5a2ecc0dc970c9d1e90830a87863963184efc6f94d027a9ae38
webkit2gtk3-devel-debuginfo-2.54.2-3.el9_9.aarch64.rpm SHA-256: 92bd8ccbdbde0988622ec7e0deeb27c4af799699ceb03843c71b08701a458db2
webkit2gtk3-jsc-2.54.2-3.el9_9.aarch64.rpm SHA-256: d02e5c6399bcc770508ed37e6180be07beb73a488d5798fb461f4bf68d414385
webkit2gtk3-jsc-debuginfo-2.54.2-3.el9_9.aarch64.rpm SHA-256: 5e2ed5d30d557c33cf212295e3996b3338740939a2e94dfdbd595ce20e5257c4
webkit2gtk3-jsc-devel-2.54.2-3.el9_9.aarch64.rpm SHA-256: 42725dfb76afa7f9561bff4ef0b199f4cd2ebf4dde7a5e1b96d9310d0ac928a9
webkit2gtk3-jsc-devel-debuginfo-2.54.2-3.el9_9.aarch64.rpm SHA-256: 9ec225401a5b391f75acbf8cc575c36a5b511d4adb3bd7b6dde88ff1d8765e01

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.