{
  "cveId": "CVE-2024-43097",
  "url": "https://patchblox.com/security/cve/CVE-2024-43097",
  "summary": "CVE-2024-43097 is fixed in 14 products on 1 platform, first by DEBIAN-CVE-2024-43097, released January 3, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "webkit2gtk3: This update for webkit2gtk3 fixes the following issues:\n\nSecurity issues fixed:\n\nWebKitGTK and WPE WebKit Security Ad...",
  "description": "This update for webkit2gtk3 fixes the following issues:\n\nSecurity issues fixed:\n\nWebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):\n\n- CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to\n  remote code execution.\n- CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local\n  escalation of privilege.\n- CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of\n  SkBlurMaskFilterImpl.cpp could lead to remote code execution.\n- CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local\n  escalation of privilege.\n- CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to perform out of bounds memory access via a crafted HTML page.\n- CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially exploit heap corruption via a crafted HTML page.\n- CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially exploit heap corruption via a crafted HTML page.\n- CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially exploit heap corruption via a crafted HTML page.\n- CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory\n  write via a crafted HTML page.\n- CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via malicious network traffic.\n- CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp\n  could lead to remote escalation of privilege.\n- CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of\n  privilege.\n- CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local\n  information disclosure.\n- CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon\n  successful exploitation.\n- CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory\n  access via a crafted HTML page.\n- CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to execute arbitrary code inside a sandbox via a crafted HTML page.\n- CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised\n  the renderer process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-10019: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-10881: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker to potentially\n  perform a sandbox escape via a crafted HTML page.\n- CVE-2026-10883: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-10889: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-10907: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-10919: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-10941: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker to execute arbitrary\n  code inside a sandbox via a crafted HTML page.\n- CVE-2026-10974: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-10977: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-10979: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-10985: Out of bounds read in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-10993: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to obtain potentially\n  sensitive information from process memory via a crafted HTML page.\n- CVE-2026-10994: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-11004: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.\n- CVE-2026-11024: Stack buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit stack\n  corruption via a crafted HTML page.\n- CVE-2026-11039: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-11040: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-11051: Out of bounds read in ANGLE in Google Chrome on Linux allowed a remote attacker to obtain potentially\n  sensitive information from process memory via a crafted HTML page.\n- CVE-2026-11057: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to obtain potentially sensitive information from process memory via a crafted HTML page.\n- CVE-2026-11061: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-11065: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-11066: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-11087: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-11088: Integer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-11090: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-11104: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to obtain potentially sensitive information from process memory via a crafted HTML page.\n- CVE-2026-11109: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-11110: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-11111: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to perform an out of bounds\n  memory read via a crafted HTML page.\n- CVE-2026-11113: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-11121: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-11123: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-11124: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-11137: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-11138: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-11159: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-11191: Out of bounds memory access in ANGLE in Google Chrome allowed a remote attacker to potentially perform\n  out of bounds memory access via a crafted HTML page.\n- CVE-2026-11663: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-11675: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-13780: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-13781: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-13834: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-13841: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-13859: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to potentially\n  perform a sandbox escape via a crafted HTML page.\n- CVE-2026-13877: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML\n  page.\n- CVE-2026-13883: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-13971: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to obtain potentially sensitive information from process memory via a crafted HTML page.\n- CVE-2026-14044: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14125: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-14152: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker who had compromised\n  the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14382: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14386: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-14387: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-14388: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-14389: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14390: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-14396: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-14398: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-14400: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14410: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised\n  the renderer process to perform UI spoofing via a crafted HTML page.\n- CVE-2026-14411: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14412: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14413: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14414: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML\n  page.\n- CVE-2026-14418: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-14419: Use after free in Skia in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-14425: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-14427: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-14429: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-15109: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-15766: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-15774: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-16413: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-16417: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-17653: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17655: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17667: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-17668: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-17671: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17675: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17678: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17682: Integer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17683: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to obtain potentially\n  sensitive information from process memory via a crafted HTML page.\n- CVE-2026-17687: Type Confusion in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17689: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-17697: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-17702: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised\n  the renderer process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-17704: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17714: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-17717: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-17718: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-17721: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a\n  sandbox escape via a crafted HTML page.\n- CVE-2026-17740: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-17745: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17750: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-17757: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-17771: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-17785: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-17801: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker to potentially\n  perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17832: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17847: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-17914: Side-channel information leakage in Skia in Google Chrome allowed a remote attacker to obtain\n  potentially sensitive information from process memory via a crafted HTML page.\n- CVE-2026-19160: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-19161: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-19173: Out of bounds write in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-19176: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to execute arbitrary code inside a sandbox via a crafted HTML page.\n- CVE-2026-3536: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform out of\n  bounds memory access via a crafted HTML page.\n- CVE-2026-3538: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially perform out of\n  bounds memory access via a crafted HTML page.\n- CVE-2026-3909: Out of bounds write in Skia in Google Chrome allowed a remote attacker to perform out of bounds memory\n  access via a crafted HTML page.\n- CVE-2026-3931: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to perform out of bounds memory\n  access via a crafted HTML page.\n- CVE-2026-43670: A Content Security Policy bypass in AudioWorklet contexts that allowed processing maliciously crafted\n  web content was addressed with improved enforcement.\n- CVE-2026-4448: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-4460: Out of bounds read in Skia in Google Chrome allowed a remote attacker to perform an out of bounds\n  memory read via a crafted HTML page.\n- CVE-2026-4464: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-5283: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin\n  data via a crafted HTML page.\n- CVE-2026-5870: Integer overflow in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a\n  sandbox via a crafted HTML page.\n- CVE-2026-6296: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform a\n  sandbox escape via a crafted HTML page.\n- CVE-2026-6298: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-6364: Out of bounds read in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted file.\n- CVE-2026-64715: A use-after-free issue that may lead to an unexpected process crash when processing maliciously\n  crafted web content was addressed with improved memory management.\n- CVE-2026-64718: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash\n  (bsc#1277001).  \n- CVE-2026-64753: A permissions issue that may disclose sensitive user information when processing maliciously crafted\n  web content was addressed by removing the vulnerable code.\n- CVE-2026-64778: A vulnerability that may leak sensitive data when visiting a maliciously crafted website was addressed\n  with improved checks.\n- CVE-2026-64779: A memory corruption vulnerability that may lead to an unexpected crash when processing maliciously\n  crafted web content was addressed with improved locking.\n- CVE-2026-64780: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed with improved checks.\n- CVE-2026-64781: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed with improved input validation.\n- CVE-2026-64782: A memory corruption vulnerability that may lead to an unexpected crash when processing maliciously\n  crafted web content was addressed with improved locking.\n- CVE-2026-64784: An out-of-bounds access issue that may lead to an unexpected crash when processing maliciously crafted\n  web content was addressed with improved bounds checking.\n- CVE-2026-65331: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed through improved state management.\n- CVE-2026-65332: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed through improved state management.\n- CVE-2026-65333: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed through improved state management.\n- CVE-2026-65334: A memory corruption issue that may lead to an unexpected crash when processing maliciously crafted web\n  content was addressed with improved state management.\n- CVE-2026-65336: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed through improved state management.\n- CVE-2026-65337: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed through improved state management.\n- CVE-2026-65338: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed with improved memory handling.\n- CVE-2026-65340: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed through improved state management.\n- CVE-2026-65341: A vulnerability that may lead to memory corruption when processing maliciously crafted web content was\n  addressed with improved memory handling.\n- CVE-2026-65351: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content\n  was addressed through improved state management.\n- CVE-2026-7353: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-7354: Out of bounds read and write in Angle in Google Chrome allowed a remote attacker to potentially perform\n  a sandbox escape via a crafted HTML page.\n- CVE-2026-7359: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-76041: Information leak in Skia in Google Chrome allowed a remote attacker to potentially bypass web origin\n  policy via a crafted HTML page.\n- CVE-2026-78376: use-after-free of \u0060JSCValue\u0060 function parameters (bsc#1276418).\n- CVE-2026-78904: Type confusion in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary\n  code outside the sandbox via a crafted HTML page.\n- CVE-2026-78905: Type confusion in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary\n  code outside the sandbox via a crafted HTML page.\n- CVE-2026-78906: Race condition in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary\n  code outside the sandbox via a crafted HTML page.\n- CVE-2026-78914: Uninitialized resource in Skia in Google Chrome allowed a remote attacker to potentially read memory\n  inside the sandbox via a crafted HTML page.\n- CVE-2026-78958: Uninitialized resource in Skia in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially obtain cross-origin data via a crafted HTML page.\n- CVE-2026-78965: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to obtain cross-origin data\n  via a crafted HTML page.\n- CVE-2026-7900: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-79020: Out of bounds read in Skia in Google Chrome allowed a remote attacker to potentially read memory\n  inside the sandbox via a crafted media file.\n- CVE-2026-79043: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute\n  arbitrary code outside the sandbox via a crafted HTML page.\n- CVE-2026-79112: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to read memory inside the sandbox via a crafted HTML page.\n- CVE-2026-79118: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to obtain cross-origin data\n  via a crafted HTML page.\n- CVE-2026-79120: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to potentially obtain\n  cross-origin data via a crafted HTML page.\n- CVE-2026-79127: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code\n  outside the sandbox via a crafted HTML page.\n- CVE-2026-79130: Buffer overflow in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside\n  the sandbox via a crafted HTML page.\n- CVE-2026-79131: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code\n  outside the sandbox via a crafted HTML page.\n- CVE-2026-79144: Information leak in Skia in Google Chrome allowed a remote attacker to obtain cross-origin data via a\n  crafted HTML page.\n- CVE-2026-79147: Information leak in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially obtain sensitive information via a crafted HTML page.\n- CVE-2026-79149: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside\n  the sandbox via a crafted HTML page.\n- CVE-2026-79188: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute\n  arbitrary code outside the sandbox via a crafted HTML page.\n- CVE-2026-79189: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute\n  arbitrary code outside the sandbox via a crafted HTML page.\n- CVE-2026-7920: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-79229: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to read memory outside the sandbox via a crafted HTML page.\n- CVE-2026-7923: Out of bounds write in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-79269: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to potentially bypass web\n  origin policy via a crafted HTML page.\n- CVE-2026-79270: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to read memory outside the\n  sandbox via a crafted HTML page.\n- CVE-2026-79275: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside\n  the sandbox via a crafted HTML page.\n- CVE-2026-7942: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-7943: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to perform arbitrary read/write via a crafted HTML page.\n- CVE-2026-7949: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted Chrome Extension.\n- CVE-2026-83596: webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (bsc#1277755).\n- CVE-2026-84635: A logic issue that may lead to an unexpected process termination when processing maliciously crafted\n  web content was addressed with improved state management.\n- CVE-2026-8579: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to perform an out of bounds memory write via a crafted print file.\n- CVE-2026-86898: A logic issue that may lead to universal cross-site scripting when opening a maliciously crafted\n  webarchive file was addressed with improved state management.\n- CVE-2026-9877: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9878: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a\n  sandbox via a crafted HTML page.\n- CVE-2026-9879: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code via a\n  crafted HTML page.\n- CVE-2026-9882: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-9893: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9899: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9900: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9901: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to execute arbitrary code via a crafted HTML page.\n- CVE-2026-9904: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox\n  escape via a crafted HTML page.\n- CVE-2026-9908: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-9909: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to execute arbitrary code inside a sandbox via a crafted HTML page.\n- CVE-2026-9910: Out of bounds memory access in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary\n  code inside a sandbox via a crafted HTML page.\n- CVE-2026-9911: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to perform an out of bounds memory\n  read via a crafted HTML page.\n- CVE-2026-9913: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to potentially perform\n  out of bounds memory access via a crafted HTML page.\n- CVE-2026-9914: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9915: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9916: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9923: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption\n  via a crafted HTML page.\n- CVE-2026-9925: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9926: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the\n  renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9927: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a\n  sandbox via a crafted HTML page.\n- CVE-2026-9935: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a\n  crafted HTML page.\n- CVE-2026-9940: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-9941: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a\n  sandbox via a crafted HTML page.\n- CVE-2026-9942: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to bypass site isolation via a crafted HTML page.\n- CVE-2026-9944: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to leak cross-origin data via a crafted HTML page.\n- CVE-2026-9946: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9953: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive\n  information from process memory via a crafted HTML page.\n- CVE-2026-9965: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap\n  corruption via a crafted HTML page.\n- CVE-2026-9969: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to\n  execute arbitrary code via a crafted HTML page.\n- CVE-2026-9975: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker who had compromised\n  the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9981: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker to obtain potentially\n  sensitive information from process memory via a crafted HTML page.\n- CVE-2026-9982: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had\n  compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n- CVE-2026-9983: Type Confusion in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a\n  sandbox via a crafted HTML page.\n- CVE-2026-9998: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer\n  process to potentially perform a sandbox escape via a crafted HTML page.\n  \nChanges for webkit2gtk3:\n\n- Update to version 2.54.1",
  "published": "2025-01-02T17:15:00Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00358,
  "epssPercentile": 0.29735,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "MozillaFirefox",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "128.8.0-150200.152.173.1",
      "fix": "SUSE-SU-2025:0788-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0788-1",
      "released": "2025-03-05T15:30:33Z"
    },
    {
      "platform": "linux",
      "product": "MozillaFirefox",
      "release": "sles 15.6",
      "fixedVersion": "128.8.0-150200.152.173.1",
      "fix": "SUSE-SU-2025:0788-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0788-1",
      "released": "2025-03-05T15:30:33Z"
    },
    {
      "platform": "linux",
      "product": "MozillaThunderbird",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "128.8.0-150200.8.203.1",
      "fix": "SUSE-SU-2025:0849-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0849-1",
      "released": "2025-03-12T15:12:43Z"
    },
    {
      "platform": "linux",
      "product": "MozillaThunderbird",
      "release": "sles 15.6",
      "fixedVersion": "128.8.0-150200.8.203.1",
      "fix": "SUSE-SU-2025:0849-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0849-1",
      "released": "2025-03-12T15:12:43Z"
    },
    {
      "platform": "linux",
      "product": "firefox-esr",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "128.8.0esr-1~deb11u1",
      "fix": "DLA-4078-1",
      "url": "https://patchblox.com/security/fix/linux/dla-4078-1",
      "released": "2025-03-06T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-esr",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "128.8.0esr-1~deb12u1",
      "fix": "DSA-5874-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5874-1",
      "released": "2025-03-05T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-esr",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "128.8.0esr-1",
      "fix": "DEBIAN-CVE-2024-43097",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43097",
      "released": "2025-01-03T01:15:07Z"
    },
    {
      "platform": "linux",
      "product": "firefox-esr",
      "release": "Debian 14",
      "fixedVersion": "128.8.0esr-1",
      "fix": "DEBIAN-CVE-2024-43097",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43097",
      "released": "2025-01-03T01:15:07Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "1:128.8.0esr-1~deb11u1",
      "fix": "DLA-4081-1",
      "url": "https://patchblox.com/security/fix/linux/dla-4081-1",
      "released": "2025-03-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:128.8.0esr-1~deb12u1",
      "fix": "DSA-5876-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5876-1",
      "released": "2025-03-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:128.8.0esr-1",
      "fix": "DEBIAN-CVE-2024-43097",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43097",
      "released": "2025-01-03T01:15:07Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Debian 14",
      "fixedVersion": "1:128.8.0esr-1",
      "fix": "DEBIAN-CVE-2024-43097",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43097",
      "released": "2025-01-03T01:15:07Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "fix": "thunderbird 1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-thunderbird-1-128.12.0-build1-0ubuntu0.22.04.1",
      "released": "2025-06-24T06:15:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird-gnome-support",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "fix": "thunderbird-gnome-support 1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-thunderbird-gnome-support-1-128.12.0-build1-0ubuntu0.22.04.1",
      "released": "2025-06-24T06:15:00Z"
    },
    {
      "platform": "linux",
      "product": "thunderbird-mozsymbols",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "fix": "thunderbird-mozsymbols 1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-thunderbird-mozsymbols-1-128.12.0-build1-0ubuntu0.22.04.1",
      "released": "2025-06-24T06:15:00Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.54.0-1~deb13u1",
      "fix": "DEBIAN-CVE-2024-43097",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43097",
      "released": "2025-01-03T01:15:07Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22076-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22076-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "sles 15.6",
      "fixedVersion": "2.54.1-150600.12.81.3",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "sles 15.7",
      "fixedVersion": "2.54.1-150600.12.81.3",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3",
      "release": "sles 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "SUSE-SU-2026:24225-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24225-1",
      "released": "2026-11-07T00:44:01Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-soup2",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22076-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22076-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-soup2",
      "release": "sles 15.6",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk3-soup2",
      "release": "sles 15.7",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "OPENSUSE-SU-2026:22076-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22076-1",
      "released": "2026-11-07T00:47:19Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "sles 15.6",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "sles 15.7",
      "fixedVersion": "2.54.1-150600.12.81.4",
      "fix": "SUSE-SU-2026:4858-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4858-1",
      "released": "2026-11-07T00:41:11Z"
    },
    {
      "platform": "linux",
      "product": "webkit2gtk4",
      "release": "sles 16.0",
      "fixedVersion": "2.54.1-160000.1.1",
      "fix": "SUSE-SU-2026:24225-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-24225-1",
      "released": "2026-11-07T00:44:01Z"
    },
    {
      "platform": "linux",
      "product": "wpewebkit",
      "release": "Debian 14",
      "fixedVersion": "2.54.0-1",
      "fix": "DEBIAN-CVE-2024-43097",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43097",
      "released": "2025-01-03T01:15:07Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-calendar-timezones",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "fix": "xul-ext-calendar-timezones 1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-xul-ext-calendar-timezones-1-128.12.0-build1-0ubuntu0.22.04.1",
      "released": "2025-06-24T06:15:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-gdata-provider",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "fix": "xul-ext-gdata-provider 1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-xul-ext-gdata-provider-1-128.12.0-build1-0ubuntu0.22.04.1",
      "released": "2025-06-24T06:15:00Z"
    },
    {
      "platform": "linux",
      "product": "xul-ext-lightning",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "fix": "xul-ext-lightning 1:128.12.0\u002Bbuild1-0ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-xul-ext-lightning-1-128.12.0-build1-0ubuntu0.22.04.1",
      "released": "2025-06-24T06:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}