# CVE-2024-43091: webkit2gtk3: This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Ad... CVE-2024-43091 is fixed in 5 products on 1 platform, first by DEBIAN-CVE-2024-43091, released November 13, 2024. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2024-43091 - Priority: Urgent - CVSS: 9.8 (critical) - EPSS: 0.0073 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Nov 13, 2024 ## Description This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619): - CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution. - CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege. - CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution. - CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege. - CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page. - CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. - CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. - CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. - CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege. - CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege. - CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure. - CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation. - CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. - CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-10019: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-10881: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10883: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-10889: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10907: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-10919: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10941: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-10974: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-10977: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-10979: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-10985: Out of bounds read in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-10993: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-10994: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11004: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11024: Stack buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. - CVE-2026-11039: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-11040: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11051: Out of bounds read in ANGLE in Google Chrome on Linux allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11057: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11061: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11065: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11066: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11087: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-11088: Integer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11090: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-11104: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11109: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-11110: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-11111: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. - CVE-2026-11113: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11121: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-11123: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11124: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-11137: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-11138: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-11159: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-11191: Out of bounds memory access in ANGLE in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. - CVE-2026-11663: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-11675: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-13780: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-13781: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-13834: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-13841: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-13859: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-13877: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-13883: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-13971: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-14044: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14125: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-14152: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14382: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14386: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-14387: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14388: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-14389: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14390: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14396: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-14398: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14400: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14410: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. - CVE-2026-14411: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14412: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14413: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14414: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-14418: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-14419: Use after free in Skia in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14425: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14427: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-14429: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-15109: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-15766: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-15774: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-16413: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-16417: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-17653: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17655: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17667: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-17668: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-17671: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17675: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17678: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17682: Integer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17683: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-17687: Type Confusion in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17689: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-17697: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17702: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-17704: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17714: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-17717: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17718: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17721: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17740: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-17745: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17750: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17757: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-17771: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-17785: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-17801: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17832: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17847: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-17914: Side-channel information leakage in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-19160: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-19161: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-19173: Out of bounds write in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-19176: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-3536: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. - CVE-2026-3538: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. - CVE-2026-3909: Out of bounds write in Skia in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. - CVE-2026-3931: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. - CVE-2026-43670: A Content Security Policy bypass in AudioWorklet contexts that allowed processing maliciously crafted web content was addressed with improved enforcement. - CVE-2026-4448: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-4460: Out of bounds read in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. - CVE-2026-4464: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-5283: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-5870: Integer overflow in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-6296: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-6298: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-6364: Out of bounds read in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. - CVE-2026-64715: A use-after-free issue that may lead to an unexpected process crash when processing maliciously crafted web content was addressed with improved memory management. - CVE-2026-64718: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (bsc#1277001). - CVE-2026-64753: A permissions issue that may disclose sensitive user information when processing maliciously crafted web content was addressed by removing the vulnerable code. - CVE-2026-64778: A vulnerability that may leak sensitive data when visiting a maliciously crafted website was addressed with improved checks. - CVE-2026-64779: A memory corruption vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved locking. - CVE-2026-64780: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved checks. - CVE-2026-64781: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved input validation. - CVE-2026-64782: A memory corruption vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved locking. - CVE-2026-64784: An out-of-bounds access issue that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved bounds checking. - CVE-2026-65331: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management. - CVE-2026-65332: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management. - CVE-2026-65333: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management. - CVE-2026-65334: A memory corruption issue that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved state management. - CVE-2026-65336: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management. - CVE-2026-65337: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management. - CVE-2026-65338: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved memory handling. - CVE-2026-65340: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management. - CVE-2026-65341: A vulnerability that may lead to memory corruption when processing maliciously crafted web content was addressed with improved memory handling. - CVE-2026-65351: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management. - CVE-2026-7353: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-7354: Out of bounds read and write in Angle in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-7359: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-76041: Information leak in Skia in Google Chrome allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. - CVE-2026-78376: use-after-free of `JSCValue` function parameters (bsc#1276418). - CVE-2026-78904: Type confusion in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-78905: Type confusion in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-78906: Race condition in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-78914: Uninitialized resource in Skia in Google Chrome allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. - CVE-2026-78958: Uninitialized resource in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. - CVE-2026-78965: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to obtain cross-origin data via a crafted HTML page. - CVE-2026-7900: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-79020: Out of bounds read in Skia in Google Chrome allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. - CVE-2026-79043: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-79112: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. - CVE-2026-79118: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to obtain cross-origin data via a crafted HTML page. - CVE-2026-79120: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. - CVE-2026-79127: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-79130: Buffer overflow in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-79131: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-79144: Information leak in Skia in Google Chrome allowed a remote attacker to obtain cross-origin data via a crafted HTML page. - CVE-2026-79147: Information leak in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. - CVE-2026-79149: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-79188: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-79189: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-7920: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-79229: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. - CVE-2026-7923: Out of bounds write in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-79269: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. - CVE-2026-79270: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. - CVE-2026-79275: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. - CVE-2026-7942: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-7943: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. - CVE-2026-7949: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome Extension. - CVE-2026-83596: webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (bsc#1277755). - CVE-2026-84635: A logic issue that may lead to an unexpected process termination when processing maliciously crafted web content was addressed with improved state management. - CVE-2026-8579: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted print file. - CVE-2026-86898: A logic issue that may lead to universal cross-site scripting when opening a maliciously crafted webarchive file was addressed with improved state management. - CVE-2026-9877: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9878: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-9879: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code via a crafted HTML page. - CVE-2026-9882: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-9893: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9899: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9900: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9901: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. - CVE-2026-9904: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9908: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-9909: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-9910: Out of bounds memory access in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-9911: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. - CVE-2026-9913: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. - CVE-2026-9914: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9915: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9916: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9923: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-9925: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9926: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9927: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-9935: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page. - CVE-2026-9940: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-9941: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-9942: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. - CVE-2026-9944: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. - CVE-2026-9946: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9953: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-9965: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2026-9969: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code via a crafted HTML page. - CVE-2026-9975: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9981: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. - CVE-2026-9982: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. - CVE-2026-9983: Type Confusion in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. - CVE-2026-9998: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Changes for webkit2gtk3: - Update to version 2.54.1 ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | webkit2gtk Debian 13.5 (trixie) | 2.54.0-1~deb13u1 | [DEBIAN-CVE-2024-43091](https://patchblox.com/security/data/fix/linux/debian-cve-2024-43091.md) | Nov 13, 2024 | | Linux | webkit2gtk3 opensuse-leap 16.0 | 2.54.1-160000.1.1 | [OPENSUSE-SU-2026:22076-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22076-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3 sles 15.6 | 2.54.1-150600.12.81.3 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3 sles 15.7 | 2.54.1-150600.12.81.3 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3 sles 16.0 | 2.54.1-160000.1.1 | [SUSE-SU-2026:24225-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24225-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3-soup2 opensuse-leap 16.0 | 2.54.1-160000.1.1 | [OPENSUSE-SU-2026:22076-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22076-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3-soup2 sles 15.6 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3-soup2 sles 15.7 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 opensuse-leap 16.0 | 2.54.1-160000.1.1 | [OPENSUSE-SU-2026:22076-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22076-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 sles 15.6 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 sles 15.7 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 sles 16.0 | 2.54.1-160000.1.1 | [SUSE-SU-2026:24225-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24225-1.md) | Nov 7, 2026 | | Linux | wpewebkit Debian 14 | 2.54.0-1 | [DEBIAN-CVE-2024-43091](https://patchblox.com/security/data/fix/linux/debian-cve-2024-43091.md) | Nov 13, 2024 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.