Linux · Security advisory · September 22, 2026

RLSA-2026:69098: webkit2gtk3 security update

RLSA-2026:69098, released September 22, 2026, fixes 112 CVEs in webkit2gtk3 (version 0:2.54.0-1.el9_8). One of them is being exploited (CVE-2026-3909); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
112
7 rated Critical
Exploited
1
CVE-2026-3909
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0995
95th percentile

Priority of the 112 CVEs

Patch now 1 Urgent 7 High 104 Routine 0

Fixed package versions

ProductReleaseFixed in
webkit2gtk3rocky 90:2.54.0-1.el9_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2026-3909 Chromium: CVE-2026-3909 Out of bounds write in Skia 9.6 0.0234 KEVExploited
Urgent CVE-2026-13885 Chromium: CVE-2026-13885 Use after free in Skia 9.6 0.0046 None reported
Urgent CVE-2026-13781 Chromium: CVE-2026-13781 Insufficient validation of untrusted input in Skia 9.6 0.0043 None reported
Urgent CVE-2023-4860 chromium: Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compro... 9.6 0.0037 None reported
Urgent CVE-2026-13820 Chromium: CVE-2026-13820 Out of bounds read in Skia 9.6 0.0034 None reported
Urgent CVE-2026-14387 Google Chrome: Integer overflow 9.6 0.0029 None reported
Urgent CVE-2026-14419 Chromium: CVE-2026-14419 Use after free in Skia 9.6 0.0023 None reported
Urgent CVE-2026-11099 Chromium: CVE-2026-11099 Vulnerability in Skia 9.6 n/a None reported
High CVE-2026-8510 Chromium: CVE-2026-8510 Integer overflow in Skia 9.6 0.0995 None reported
High CVE-2026-3538 Chromium: CVE-2026-3538 Integer overflow in Skia 9.6 0.0078 None reported
High CVE-2024-7966 Chromium: CVE-2024-7966 Out of bounds memory access in Skia 9.6 0.0071 None reported
High CVE-2026-65331 webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform 9.6 0.0065 None reported
High CVE-2026-65332 webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform 9.6 0.0065 None reported
High CVE-2026-65337 webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform 9.6 0.0065 None reported
High CVE-2026-65340 webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform 9.6 0.0065 None reported
High CVE-2026-65351 WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash 9.6 0.0065 None reported
High CVE-2024-8636 Chromium: CVE-2024-8636 Heap buffer overflow in Skia 9.6 0.0065 None reported
High CVE-2026-64780 WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash 9.6 0.0063 None reported
High CVE-2024-8198 Chromium: CVE-2024-8198 Heap buffer overflow in Skia 9.6 0.0061 None reported
High CVE-2024-8193 chromium: Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised t... 9.6 0.0059 None reported
High CVE-2025-0436 Chromium: CVE-2025-0436 Integer overflow in Skia 9.6 0.0059 None reported
High CVE-2026-43795 WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash 9.6 0.0058 None reported
High CVE-2026-64784 WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash 9.6 0.0058 None reported
High CVE-2026-65334 WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash 9.6 0.0058 None reported
High CVE-2026-65335 webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform 9.6 0.0058 None reported
Showing 1 to 25 of 112 1Next