{"affected":[{"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"},"package":{"ecosystem":"AlmaLinux:9","name":"webkit2gtk3","purl":"pkg:rpm/almalinux/webkit2gtk3"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.54.2-0.el9_8.2"}],"type":"ECOSYSTEM"}]},{"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"},"package":{"ecosystem":"AlmaLinux:9","name":"webkit2gtk3-devel","purl":"pkg:rpm/almalinux/webkit2gtk3-devel"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.54.2-0.el9_8.2"}],"type":"ECOSYSTEM"}]},{"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"},"package":{"ecosystem":"AlmaLinux:9","name":"webkit2gtk3-jsc","purl":"pkg:rpm/almalinux/webkit2gtk3-jsc"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.54.2-0.el9_8.2"}],"type":"ECOSYSTEM"}]},{"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"},"package":{"ecosystem":"AlmaLinux:9","name":"webkit2gtk3-jsc-devel","purl":"pkg:rpm/almalinux/webkit2gtk3-jsc-devel"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.54.2-0.el9_8.2"}],"type":"ECOSYSTEM"}]}],"details":"WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.  \n\nSecurity Fix(es):  \n\n  * chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)\n  * chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)\n  * chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)\n  * chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)\n  * chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)\n  * chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)\n  * chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)\n  * chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)\n  * chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)\n  * chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)\n  * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)\n  * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)\n  * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)\n  * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)\n  * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)\n  * chromium-browser: skia: Use after free in Skia (CVE-2026-119271)\n  * chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","id":"ALSA-2026:95194","modified":"2026-11-05T00:00:02.282074062Z","published":"2026-11-04T00:00:00Z","references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:95194"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102325"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-103629"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-106379"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-106399"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-113106"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-118319"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-118340"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-118348"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-118351"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-118354"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-119261"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-119271"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-85049"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-91733"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-91740"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-91747"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-93387"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2528197"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2534512"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2534705"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2534759"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2537950"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2543588"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2545277"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2546915"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2547009"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2556522"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2562464"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2562477"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2562479"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2562486"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2562496"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2563744"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2563759"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-95194.html"}],"related":["CVE-2026-102325","CVE-2026-103629","CVE-2026-106379","CVE-2026-106399","CVE-2026-113106","CVE-2026-118319","CVE-2026-118340","CVE-2026-118348","CVE-2026-118351","CVE-2026-118354","CVE-2026-119261","CVE-2026-119271","CVE-2026-85049","CVE-2026-91733","CVE-2026-91740","CVE-2026-91747","CVE-2026-93387"],"schema_version":"1.9.2","summary":"Important: webkit2gtk3 security update","upstream":["CVE-2026-102325","CVE-2026-103629","CVE-2026-106379","CVE-2026-106399","CVE-2026-113106","CVE-2026-118319","CVE-2026-118340","CVE-2026-118348","CVE-2026-118351","CVE-2026-118354","CVE-2026-119261","CVE-2026-119271","CVE-2026-85049","CVE-2026-91733","CVE-2026-91740","CVE-2026-91747","CVE-2026-93387"]}