alsa-2026:95194
osv_almalinux
Description
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049) * chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747) * chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733) * chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740) * chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387) * chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325) * chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629) * chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379) * chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106) * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340) * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319) * chromium-browser: skia: Use after free in Skia (CVE-2026-119271) * chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
- https://access.redhat.com/errata/RHSA-2026:95194
- https://access.redhat.com/security/cve/CVE-2026-102325
- https://access.redhat.com/security/cve/CVE-2026-103629
- https://access.redhat.com/security/cve/CVE-2026-106379
- https://access.redhat.com/security/cve/CVE-2026-106399
- https://access.redhat.com/security/cve/CVE-2026-113106
- https://access.redhat.com/security/cve/CVE-2026-118319
- https://access.redhat.com/security/cve/CVE-2026-118340
- https://access.redhat.com/security/cve/CVE-2026-118348
- https://access.redhat.com/security/cve/CVE-2026-118351
- https://access.redhat.com/security/cve/CVE-2026-118354
- https://access.redhat.com/security/cve/CVE-2026-119261
- https://access.redhat.com/security/cve/CVE-2026-119271
- https://access.redhat.com/security/cve/CVE-2026-85049
- https://access.redhat.com/security/cve/CVE-2026-91733
- https://access.redhat.com/security/cve/CVE-2026-91740
- https://access.redhat.com/security/cve/CVE-2026-91747
- https://access.redhat.com/security/cve/CVE-2026-93387
- https://bugzilla.redhat.com/2528197
- https://bugzilla.redhat.com/2534512
- https://bugzilla.redhat.com/2534705
- https://bugzilla.redhat.com/2534759
- https://bugzilla.redhat.com/2537950
- https://bugzilla.redhat.com/2543588
- https://bugzilla.redhat.com/2545277
- https://bugzilla.redhat.com/2546915
- https://bugzilla.redhat.com/2547009
- https://bugzilla.redhat.com/2556522
- https://bugzilla.redhat.com/2562464
- https://bugzilla.redhat.com/2562477
- https://bugzilla.redhat.com/2562479
- https://bugzilla.redhat.com/2562486
- https://bugzilla.redhat.com/2562496
- https://bugzilla.redhat.com/2563744
- https://bugzilla.redhat.com/2563759
- https://errata.almalinux.org/9/ALSA-2026-95194.html
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"
},
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3",
"purl": "pkg:rpm/almalinux/webkit2gtk3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.2-0.el9_8.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"
},
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-devel",
"purl": "pkg:rpm/almalinux/webkit2gtk3-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.2-0.el9_8.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"
},
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-jsc",
"purl": "pkg:rpm/almalinux/webkit2gtk3-jsc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.2-0.el9_8.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:95194.json"
},
"package": {
"ecosystem": "AlmaLinux:9",
"name": "webkit2gtk3-jsc-devel",
"purl": "pkg:rpm/almalinux/webkit2gtk3-jsc-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.2-0.el9_8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. \n\nSecurity Fix(es): \n\n * chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)\n * chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)\n * chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)\n * chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)\n * chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)\n * chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)\n * chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)\n * chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)\n * chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)\n * chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)\n * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)\n * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)\n * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)\n * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)\n * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)\n * chromium-browser: skia: Use after free in Skia (CVE-2026-119271)\n * chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:95194",
"modified": "2026-11-05T00:00:02.282074062Z",
"published": "2026-11-04T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:95194"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-102325"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-103629"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-106379"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-106399"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-113106"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-118319"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-118340"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-118348"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-118351"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-118354"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-119261"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-119271"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-85049"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-91733"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-91740"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-91747"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-93387"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2528197"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2534512"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2534705"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2534759"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2537950"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2543588"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2545277"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2546915"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2547009"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2556522"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2562464"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2562477"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2562479"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2562486"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2562496"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2563744"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2563759"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-95194.html"
}
],
"related": [
"CVE-2026-102325",
"CVE-2026-103629",
"CVE-2026-106379",
"CVE-2026-106399",
"CVE-2026-113106",
"CVE-2026-118319",
"CVE-2026-118340",
"CVE-2026-118348",
"CVE-2026-118351",
"CVE-2026-118354",
"CVE-2026-119261",
"CVE-2026-119271",
"CVE-2026-85049",
"CVE-2026-91733",
"CVE-2026-91740",
"CVE-2026-91747",
"CVE-2026-93387"
],
"schema_version": "1.9.2",
"summary": "Important: webkit2gtk3 security update",
"upstream": [
"CVE-2026-102325",
"CVE-2026-103629",
"CVE-2026-106379",
"CVE-2026-106399",
"CVE-2026-113106",
"CVE-2026-118319",
"CVE-2026-118340",
"CVE-2026-118348",
"CVE-2026-118351",
"CVE-2026-118354",
"CVE-2026-119261",
"CVE-2026-119271",
"CVE-2026-85049",
"CVE-2026-91733",
"CVE-2026-91740",
"CVE-2026-91747",
"CVE-2026-93387"
]
}