Red Hat Product Errata RHSA-2026:42088 - Security Advisory Issued: 2026-07-20 Updated: 2026-07-20 RHSA-2026:42088 - Security Advisory Overview Updated Packages Synopsis Important: webkit2gtk3 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699) webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712) webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720) webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721) webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43725) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43726) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43727) webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731) webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information (CVE-2026-43732) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43734) webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43742) webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2280382 - CVE-2024-4367 Mozilla: Arbitrary JavaScript execution in PDF.js BZ - 2500519 - CVE-2026-39872 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500520 - CVE-2026-43663 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500521 - CVE-2026-43676 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500522 - CVE-2026-43699 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500523 - CVE-2026-43701 webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox BZ - 2500524 - CVE-2026-43705 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500525 - CVE-2026-43707 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500526 - CVE-2026-43712 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500527 - CVE-2026-43713 webkitgtk: webkitgtk: Visiting a website may leak sensitive data BZ - 2500528 - CVE-2026-43715 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500529 - CVE-2026-43716 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500530 - CVE-2026-43720 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500531 - CVE-2026-43721 webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data BZ - 2500532 - CVE-2026-43725 webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox BZ - 2500533 - CVE-2026-43726 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500534 - CVE-2026-43727 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500535 - CVE-2026-43731 webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption BZ - 2500536 - CVE-2026-43732 webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information BZ - 2500537 - CVE-2026-43734 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500538 - CVE-2026-43740 webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory BZ - 2500539 - CVE-2026-43742 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash BZ - 2500540 - CVE-2026-43745 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVEs CVE-2024-4367 CVE-2026-39872 CVE-2026-43663 CVE-2026-43676 CVE-2026-43699 CVE-2026-43701 CVE-2026-43705 CVE-2026-43707 CVE-2026-43712 CVE-2026-43713 CVE-2026-43715 CVE-2026-43716 CVE-2026-43720 CVE-2026-43721 CVE-2026-43725 CVE-2026-43726 CVE-2026-43727 CVE-2026-43731 CVE-2026-43732 CVE-2026-43734 CVE-2026-43740 CVE-2026-43742 CVE-2026-43745 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM webkit2gtk3-2.52.5-1.el8_10.src.rpm SHA-256: 97584ce773ab3dde47219379c83d1c97e5b796d4289f1e52d754cfcd62a7d110 x86_64 webkit2gtk3-2.52.5-1.el8_10.i686.rpm SHA-256: 156066e0825f2b8a6de3f9dcabf1a531b389c5d90556c06ed9a7354970b5a76d webkit2gtk3-2.52.5-1.el8_10.x86_64.rpm SHA-256: 616d8fb2640e8a3c8c41677b3163ecada6d6e09ea7162ec9d0e206802ebb4e3b webkit2gtk3-debuginfo-2.52.5-1.el8_10.i686.rpm SHA-256: 5f44a1c20003e222cda38d922f6dc893911f536f58f3ffd4af561674c3ee0956 webkit2gtk3-debuginfo-2.52.5-1.el8_10.x86_64.rpm SHA-256: 4a2ed20112b8b6c36e33c54ae503381aad9e16213d5cecbedd4e1d656ef59199 webkit2gtk3-debugsource-2.52.5-1.el8_10.i686.rpm SHA-256: e72264b6de0e3ed86d5309715bc889c55f86e5b39ca80677c43ff80cffd6aac8 webkit2gtk3-debugsource-2.52.5-1.el8_10.x86_64.rpm SHA-256: 7530238783f3915b6f7544e33ed52ac81395a6afb4c76c6c0e457339b5dd29f1 webkit2gtk3-devel-2.52.5-1.el8_10.i686.rpm SHA-256: 722d05065719bae51c8cf8c7d435aeaa4e6cc220efc0fd681bfd9264dee42c21 webkit2gtk3-devel-2.52.5-1.el8_10.x86_64.rpm SHA-256: b42b03aff316907b937e2e03dd1739b62a584f2d5e0eb41a6310e4c0788fed8f webkit2gtk3-devel-debuginfo-2.52.5-1.el8_10.i686.rpm SHA-256: 78461bb221f2beed695a715f6bd87806ea0688f617c3a79611663c1da325aebe webkit2gtk3-devel-debuginfo-2.52.5-1.el8_10.x86_64.rpm SHA-256: 3f21cbe07daaefd7b7aa8187e69cc45308117875e0e0e54ce22843bd12c62839 webkit2gtk3-jsc-2.52.5-1.el8_10.i686.rpm SHA-256: 923b7586b019c284a922af54b692678e4961372b1254cc5f90c60b2136df4304 webkit2gtk3-jsc-2.52.5-1.el8_10.x86_64.rpm SHA-256: d9561c4d01e7692a5f27dbb073108daf283dbb02fd184d9e408c69a3953597d0 webkit2gtk3-jsc-debuginfo-2.52.5-1.el8_10.i686.rpm SHA-256: 1a58ab2ce0e3e429c7b596332eed28758654e89227058fccda4f946e59ead049 webkit2gtk3-jsc-debuginfo-2.52.5-1.el8_10.x86_64.rpm SHA-256: a8d39445e3c160bc30ebde0374a27cace965acfa9a4eeb5343469b13df6ce7f2 webkit2gtk3-jsc-devel-2.52.5-1.el8_10.i686.rpm SHA-256: 9e8116b3ae1060eaaab4a07ea9fbc55ee85356610270cccbada9afc68752fce9 webkit2gtk3-jsc-devel-2.52.5-1.el8_10.x86_64.rpm SHA-256: 4cfcf2b0dbf55b33d75fbd213d2eb237b832c435ec47acc6db6402d7e6168cb3 webkit2gtk3-jsc-devel-debuginfo-2.52.5-1.el8_10.i686.rpm SHA-256: 28ccdad515059d811c3d26379c86f51612237bfd0ca5bd0700bfc02b45e995f5 webkit2gtk3-jsc-devel-debuginfo-2.52.5-1.el8_10.x86_64.rpm SHA-256: efc236c0df79c05dd98e3c22408498d2a567e90f3aa86e6f1863392b422b81b2 Red Hat Enterprise Linux for IBM z Systems 8 SRPM webkit2gtk3-2.52.5-1.el8_10.src.rpm SHA-256: 97584ce773ab3dde47219379c83d1c97e5b796d4289f1e52d754cfcd62a7d110 s390x webkit2gtk3-2.52.5-1.el8_10.s390x.rpm SHA-256: 812857ca339f79a37745f2e586ed5202f50064311be12f45b10306c82776422e webkit2gtk3-debuginfo-2.52.5-1.el8_10.s390x.rpm SHA-256: 2f13be9ff102057dd1ffd59c7beb492a1610538367c5aba