This update for webkit2gtk3 fixes the following issues:
Security issues fixed:
- CVE-2026-64718: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
(bsc#1277001).
- CVE-2026-65335: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash
(bsc#1277015).
- CVE-2026-78376: use-after-free of `JSCValue` function parameters (bsc#1276418).
- CVE-2026-83596: webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (bsc#1277755).
Non security issue fixed:
- libjavascriptcoregtk-4_0-18: JSGlobalContextCreate() aborts on aarch64 64 KB-pag
This update for webkit2gtk3 fixes the following issues:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):
- CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
- CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
- CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_d
This update for webkit2gtk3 fixes the following issues:
- CVE-2026-28984,CVE-2026-43804,CVE-2026-64713,CVE-2026-64719,CVE-2026-64728,
CVE-2026-64730,CVE-2026-64757,CVE-2026-64783,CVE-2026-64787:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0005 (bsc#1275791).
Changes for webkit2gtk3:
- Update to version 2.52.6
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution
(bsc#1271638).
- CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43663: maliciously crafted web content can lead to an unexpected process crash (bsc#1271638).
- CVE-2026-43676: out-of-bounds access when processing web content can lead to an unexpected Safari crash
(bsc#1271638).
- CVE-2026-43699: use-after-free issue when processing web content can lead to an unexpected process crash
(bsc#1271638).
- CVE-2026-4
This update for webkit2gtk3 fixes the following issues:
Update to version 2.52.0:
- CVE-2023-43010: processing maliciously crafted web content may lead to memory corruption (bsc#1259950).
- CVE-2025-31223: processing maliciously crafted web content may lead to memory corruption (bsc#1259949).
- CVE-2025-31277: processing maliciously crafted web content may lead to memory corruption (bsc#1259948).
- CVE-2025-43213: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259947).
- CVE-2025-43214: processing maliciously crafted web content may lead to an unexpected crash (bsc#1259946).
- CVE-2025-43433: processing mal
This update for webkit2gtk3 fixes the following issues:
Update to version 2.50.4.
Security issues fixed:
- CVE-2025-14174: processing maliciously crafted web content may lead to memory corruption due to improper validation
(bsc#1255497).
- CVE-2025-43501: processing maliciously crafted web content may lead to an unexpected process crash due to a buffer
overflow issue (bsc#1255194).
- CVE-2025-43529: processing maliciously crafted web content may lead to arbitrary code execution due to a
use-after-free issue (bsc#1255198).
- CVE-2025-43531: processing maliciously crafted web content may lead to an unexpected process crash due to a rac
This update for webkit2gtk3 fixes the following issues:
Update to version 2.50.3.
Security issues fixed:
- CVE-2025-13502: processing of maliciously crafted payloads by the GLib remote inspector server may lead to a
UIProcess crash due to an out-of-bounds read and an integer underflow (bsc#1254208).
- CVE-2025-13947: use of the file drag-and-drop mechanism may lead to remote information disclosure due to a lack of
verification of the origins of drag operations (bsc#1254473).
- CVE-2025-43392: websites may exfiltrate image data cross-origin due to issues with cache handling (bsc#1254165).
- CVE-2025-43421: processing maliciously crafted
This update for webkit2gtk3 fixes the following issues:
- CVE-2025-43343: improved memory handling in web content processing to prevent process crash (bsc#1251975)
- CVE-2025-43272: improved memory handling to prevent unexpected process crash (bsc#1250439)
- CVE-2025-43342: correctness issue was addressed with improved checks to prevent unexcepted process crash (bsc#1250440)
- CVE-2025-43356: improved handling of caches to prevent sensor access without consent (bsc#1250441)
- CVE-2025-43368: improved memory management to prevent a use-after-free (bsc#1250442)
This update for webkit2gtk3 fixes the following issues:
Updated to version 2.48.5:
- CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. (bsc#1247564)
- CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web content may lead to memory corruption. (bsc#1247563)
- CVE-2025-43211: Fixed a vulnerability where processing web content may lead to a denial-of-service. (bsc#1247562)
- CVE-2025-43212: Fixed a vulnerability where processing maliciously crafted web content may lead to an unexpected Safari crash. (bsc#1247595)
- CVE-2025-43216: Fixed a
This update for webkit2gtk3 fixes the following issues:
Update to version 2.48.2.
Security issues fixed:
- CVE-2025-31205: lack of checks may lead to cross-origin data exfiltration through a malicious website (bsc#1243282).
- CVE-2025-31204: improper memory handling when processing certain web content may lead to memory corruption
(bsc#1243286).
- CVE-2025-31206: type confusion issue when processing certain web content may lead to an unexpected crash
(bsc#1243288).
- CVE-2025-31215: lack of checks when processing certain web content may lead to an unexpected crash (bsc#1243289).
- CVE-2025-31257: improper memory handling when processin
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.48.1
- CVE-2024-54551: improper memory handling may lead to a denial-of-service when processing certain web content (bsc#1240962)
- CVE-2025-24208: permissions issue may lead to a cross-site scripting attack when loading a malicious iframe (bsc#1240961)
- CVE-2025-24209: buffer overflow may lead to crash when processing maliciously crafted web content (bsc#1240964)
- CVE-2025-24213: type confusion issue may lead to memory corruption (bsc#1240963)
- CVE-2025-24216: improper memory handling may lead to an unexpected crash when processing certain web content (bsc#1240
This update for webkit2gtk3 fixes the following issues:
- CVE-2025-24201: Fixed out-of-bounds write vulnerability due to that WebGL context primitive restart
can be toggled from WebContent process (bsc#1239547).
This update for webkit2gtk3 fixes the following issues:
Update to version 2.46.6 (bsc#1236946):
- CVE-2025-24143: A maliciously crafted webpage may be able to fingerprint the user.
- CVE-2025-24150: Copying a URL from Web Inspector may lead to command injection.
- CVE-2025-24158: Processing web content may lead to a denial-of-service.
- CVE-2025-24162: Processing maliciously crafted web content may lead to an unexpected process crash.
Already fixed in previous releases:
- CVE-2024-54543: Processing maliciously crafted web content may lead to memory corruption.
- CVE-2024-27856: Processing a file may lead to unexpected app termination or a
This update for webkit2gtk3 fixes the following issues:
Update to version 2.46.5 (bsc#1234851):
Security fixes:
- CVE-2024-54479: Processing maliciously crafted web content may lead to an unexpected process crash
- CVE-2024-54502: Processing maliciously crafted web content may lead to an unexpected process crash
- CVE-2024-54505: Processing maliciously crafted web content may lead to memory corruption
- CVE-2024-54508: Processing maliciously crafted web content may lead to an unexpected process crash
- CVE-2024-54534: Processing maliciously crafted web content may lead to memory corruption
Other fixes:
- Fix the build with GBM and relea
This update for webkit2gtk3 fixes the following issues:
Update to version 2.46.3 (bsc#1232747), including fixes for:
- CVE-2024-44308: Fixed arbitrary code execution by not allocating DFG register after a slow path (bsc#1233631).
- CVE-2024-44309: Fixed a data isolation bypass vulnerability (bsc#1233632).
- CVE-2024-44244: Processing maliciously crafted web content may lead to an unexpected process crash.
- CVE-2024-44296: Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
This update for webkit2gtk3 fixes the following issues:
Update to version 2.46.0 (bsc#1231039).
- CVE-2024-40866
- CVE-2024-44187
Already fixed in version 2.44.3:
- CVE-2024-4558
- CVE-2024-27838
- CVE-2024-27851
Already fixed in version 2.44.2:
- CVE-2024-27834
- CVE-2024-27808
- CVE-2024-27820
- CVE-2024-27833
Already fixed in version 2.44.1:
- CVE-2024-23222
- CVE-2024-23206
- CVE-2024-23213
- CVE-2024-23271
This update for webkit2gtk3 fixes the following issues:
Update to version 2.44.3 (bsc#1228696 bsc#1228697 bsc#1228698):
- Fix web process cache suspend/resume when sandbox is enabled.
- Fix accelerated images dissapearing after scrolling.
- Fix video flickering with DMA-BUF sink.
- Fix pointer lock on X11.
- Fix movement delta on mouse events in GTK3.
- Undeprecate console message API and make it available in 2022 API.
- Fix several crashes and rendering issues.
- Security fixes: CVE-2024-40776, CVE-2024-40779, CVE-2024-40780,
CVE-2024-40782, CVE-2024-40785, CVE-2024-40789, CVE-2024-40794,
CVE-2024-4558.
This update for webkit2gtk3 fixes the following issues:
- Update to version 2.44.2
- CVE-2024-27834: Fixed a vulnerability where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. (bsc#1225071)
This update for webkit2gtk3 fixes the following issues:
- CVE-2024-23252: Fixed denial of service via crafted web content (bsc#1222010).
- CVE-2024-23254: Fixed possible audio data exilftration cross-origin via malicious website (bsc#1222010).
- CVE-2024-23263: Fixed lack of Content Security Policy enforcing via malicious crafted web content (bsc#1222010).
- CVE-2024-23280: Fixed possible user fingeprint via malicious crafted web content (bsc#1222010).
- CVE-2024-23284: Fixed lack of Content Security Policy enforcing via malicious crafted web content
This update for webkit2gtk3 fixes the following issues:
Update to version 2.42.5 (bsc#1219604):
- CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution (bsc#1219113).
- CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages (bsc#1219604).
- CVE-2024-23213: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).
- CVE-2023-40414: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).
- CVE-2014-1745: Fixed denial-of-service or potentially disclose memory contents while processing maliciously crafted f