{"id":"RLSA-2026:84584","summary":"Critical: webkit2gtk3 security, bug fix, and enhancement update","details":"WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read (CVE-2026-87596)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page (CVE-2026-87500)\n\n* chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE (CVE-2026-87654)\n\n* chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability (CVE-2026-87621)\n\n* chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnerability in ANGLE (CVE-2026-87512)\n\n* chromium-browser: angle: ANGLE: Arbitrary code execution in Google Chrome due to use-after-free (CVE-2026-87648)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87602)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87586)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via out-of-bounds read (CVE-2026-87604)\n\n* chromium-browser: angle: chromium-browser: Improper input validation in ANGLE (CVE-2026-91738)\n\n* chromium-browser: angle: chromium-browser: Uninitialized resource in ANGLE (CVE-2026-91720)\n\nBug Fix(es) and Enhancement(s):\n\n* webkit2gtk3 2.54.0 regression breaks Eclipse IDE WebKit-based views on CentOS Stream 9 [rhel-8.10.z] (JIRA:Rocky Linux-274406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","modified":"2026-10-20T12:15:37.987554871Z","published":"2026-10-20T12:01:34.094814Z","upstream":["CVE-2026-87500","CVE-2026-87512","CVE-2026-87586","CVE-2026-87596","CVE-2026-87602","CVE-2026-87604","CVE-2026-87621","CVE-2026-87648","CVE-2026-87654","CVE-2026-91720","CVE-2026-91738"],"database_specific":{"license_url":"https://creativecommons.org/licenses/by/4.0/","source_advisory":"RHSA-2026:84584","license":"CC-BY-4.0"},"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:84584"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530272"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530296"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530305"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530333"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530389"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530396"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530447"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530458"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530475"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534404"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534673"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:84584"}],"affected":[{"package":{"name":"webkit2gtk3","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/webkit2gtk3?distro=rocky-linux-8&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.54.1-1.el8_10"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:84584.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}