CVE-2025-26416
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a...
9.8 CriticalFix available
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.54%Up 0.5 points since Sep 3, 2025
What each source reports
CVE List Score used
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
CVE-2025-26416- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2025-26597
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
EUVD-2025-26597- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-79r8-3f9p-3m46 No score
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a...
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
GHSA-79r8-3f9p-3m46- Updated
- 2026-11-02
NVD
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
CVE-2025-26416- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-26416
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
DEBIAN-CVE-2025-26416- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVASB-A-388480622 No score
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
ASB-A-388480622- Updated
- 2026-11-05
Show 4 moreShow less
OSVopenSUSE-SU-2026:22076-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):
- CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
- CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
- CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
- CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
- CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
- CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
- CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
- CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
- CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
- CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
- CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
- CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
- CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…
- Record
openSUSE-SU-2026:22076-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:24225-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):
- CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
- CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
- CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
- CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
- CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
- CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
- CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
- CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
- CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
- CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
- CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
- CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
- CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…
- Record
SUSE-SU-2026:24225-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4676-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):
- CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
- CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
- CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
- CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
- CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
- CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
- CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
- CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
- CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
- CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
- CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
- CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
- CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…
- Record
SUSE-SU-2026:4676-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4858-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues:
Security issues fixed:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):
- CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
- CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
- CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
- CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
- CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
- CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
- CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
- CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
- CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
- CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
- CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
- CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
- CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a…
- Record
SUSE-SU-2026:4858-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
platform/external/skiaAndroid |
15-next:0 up to 15-next:2025-04-01, plus listed versions 15-next |
15-next:2025-04-01 |
platform/external/skiaAndroid |
15:0 up to 15:2025-04-01, plus listed versions 15 |
15:2025-04-01 |
platform/external/skiaAndroid |
13:0 up to 13:2025-04-01, plus listed versions 13 |
13:2025-04-01 |
platform/external/skiaAndroid |
14:0 up to 14:2025-04-01, plus listed versions 14 |
14:2025-04-01 |
webkit2gtkDebian:12 |
All versions, plus listed versions 2.40.1-12.40.2-12.40.2-1~deb11u12.40.2-1~deb12u12.40.3-1 Show 45 moreShow less2.40.3-22.40.3-2~deb11u12.40.3-2~deb11u22.40.3-2~deb12u12.40.3-2~deb12u22.40.4-12.40.5-12.40.5-1~deb11u12.40.5-1~deb12u12.41.4-12.41.5-12.41.6-12.41.90-12.41.91-12.41.91-22.41.92-12.42.0-12.42.0-1~bpo12+12.42.1-12.42.1-1~bpo12+12.42.1-1~deb11u12.42.1-1~deb11u22.42.1-1~deb12u12.42.1-22.42.2-12.42.2-1~deb11u12.42.2-1~deb12u12.42.3-12.42.3-1~deb11u12.42.3-1~deb12u12.42.4-12.42.4-1~deb11u12.42.4-1~deb12u12.42.5-12.42.5-1~deb11u12.42.5-1~deb12u12.42.5-22.43.1-12.43.2-12.43.3-12.43.4-12.43.4-22.44.0-12.44.0-22.44.1-1 |
None known |
webkit2gtkDebian:13 |
before 2.54.0-1~deb13u1, plus listed versions 2.48.3-12.48.5-12.48.5-1~deb11u12.48.5-1~deb12u12.48.5-1~deb13u1 Show 45 moreShow less2.48.6-12.49.90-12.50.0-12.50.0-22.50.1-12.50.1-1~deb11u12.50.1-1~deb12u12.50.1-1~deb13u12.50.2-12.50.2-1~deb11u12.50.2-1~deb12u12.50.2-1~deb13u12.50.3-12.50.3-1+hurd.12.50.3-1~deb11u12.50.3-1~deb12u12.50.3-1~deb13u12.50.4-12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-12.50.6-12.50.6-1~deb11u12.50.6-1~deb12u12.50.6-1~deb12u22.50.6-1~deb13u12.51.1-12.51.2-12.51.3-12.51.4-12.51.90-12.51.91-12.51.92-12.51.93-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.3-22.52.3-2~deb13u12.52.4-12.52.5-12.52.5-1~deb13u1 |
2.54.0-1~deb13u1 |
webkit2gtkDebian:14 |
All versions, plus listed versions 2.48.3-12.48.5-12.48.5-1~deb11u12.48.5-1~deb12u12.48.5-1~deb13u1 Show 45 moreShow less2.48.6-12.49.90-12.50.0-12.50.0-22.50.1-12.50.1-1~deb11u12.50.1-1~deb12u12.50.1-1~deb13u12.50.2-12.50.2-1~deb11u12.50.2-1~deb12u12.50.2-1~deb13u12.50.3-12.50.3-1+hurd.12.50.3-1~deb11u12.50.3-1~deb12u12.50.3-1~deb13u12.50.4-12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-12.50.6-12.50.6-1~deb11u12.50.6-1~deb12u12.50.6-1~deb12u22.50.6-1~deb13u12.51.1-12.51.2-12.51.3-12.51.4-12.51.90-12.51.91-12.51.92-12.51.93-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.3-22.52.3-2~deb13u12.52.4-12.52.5-12.52.5-1~deb13u1 |
None known |
wpewebkitDebian:12 |
All versions, plus listed versions 2.38.6-12.39.91-12.40.0-12.40.1-12.40.2-1 Show 45 moreShow less2.40.2-22.40.3-12.40.4-12.40.5-12.42.0-12.42.1-12.42.2-12.42.3-12.42.4-12.42.5-12.42.5-1.12.42.5-1.1~exp12.42.5-1.22.42.5-2~exp2.44.1-12.44.2-12.44.2-22.44.3-12.44.4-12.46.1-12.46.2-12.46.3-12.46.4-12.46.5-12.46.6-12.48.0-12.48.1-12.48.1-22.48.2-12.48.3-12.48.5-12.48.6-12.48.6-22.50.0-12.50.0-22.50.1-12.50.2-12.50.3-12.50.4-12.50.5-12.50.6-12.52.0-12.52.1-12.52.2-12.52.2-2 |
None known |
wpewebkitDebian:13 |
All versions, plus listed versions 2.48.3-12.48.5-12.48.6-12.48.6-22.50.0-1 Show 17 moreShow less2.50.0-22.50.1-12.50.2-12.50.3-12.50.4-12.50.5-12.50.6-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.4-12.52.5-12.52.6-12.54.0-12.54.0-2 |
None known |
wpewebkitDebian:14 |
before 2.54.0-1, plus listed versions 2.48.3-12.48.5-12.48.6-12.48.6-22.50.0-1 Show 15 moreShow less2.50.0-22.50.1-12.50.2-12.50.3-12.50.4-12.50.5-12.50.6-12.52.0-12.52.1-12.52.2-12.52.2-22.52.3-12.52.4-12.52.5-12.52.6-1 |
2.54.0-1 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
webkit2gtk3SUSE:Linux Enterprise Server 16.0 From an advisory covering 243 CVEs |
before 2.54.1-160000.1.1 | 2.54.1-160000.1.1 |
webkit2gtk4SUSE:Linux Enterprise Server 16.0 From an advisory covering 243 CVEs |
before 2.54.1-160000.1.1 | 2.54.1-160000.1.1 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 243 CVEs |
before 2.54.1-160000.1.1 | 2.54.1-160000.1.1 |
webkit2gtk4SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 243 CVEs |
before 2.54.1-160000.1.1 | 2.54.1-160000.1.1 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk4SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 233 CVEs |
before 2.54.1-150400.4.152.2 | 2.54.1-150400.4.152.2 |
webkit2gtk3-soup2SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.4 | 2.54.1-150600.12.81.4 |
webkit2gtk4SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.4 | 2.54.1-150600.12.81.4 |
webkit2gtk3SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.3 | 2.54.1-150600.12.81.3 |
webkit2gtk4SUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.4 | 2.54.1-150600.12.81.4 |
webkit2gtk3SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.3 | 2.54.1-150600.12.81.3 |
webkit2gtk3-soup2SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.4 | 2.54.1-150600.12.81.4 |
webkit2gtk4SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.4 | 2.54.1-150600.12.81.4 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.3 | 2.54.1-150600.12.81.3 |
webkit2gtk3-soup2SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.4 | 2.54.1-150600.12.81.4 |
webkit2gtk4SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 237 CVEs |
before 2.54.1-150600.12.81.4 | 2.54.1-150600.12.81.4 |
webkit2gtk3openSUSE:Leap 16.0 From an advisory covering 243 CVEs |
before 2.54.1-160000.1.1 | 2.54.1-160000.1.1 |
webkit2gtk3-soup2openSUSE:Leap 16.0 From an advisory covering 243 CVEs |
before 2.54.1-160000.1.1 | 2.54.1-160000.1.1 |
webkit2gtk4openSUSE:Leap 16.0 From an advisory covering 243 CVEs |
before 2.54.1-160000.1.1 | 2.54.1-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-26416 is a critical vulnerability (CVSS 9.8) in Google Android, published April 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in platform/external/skia 15-next:2025-04-01.
References
android.googlesource.com/platform/external/skia/+/fc2ebb312c5898486776df981a51c2bb90e3756d
source.android.com/security/bulletin/2025-04-01
nvd.nist.gov/vuln/detail/CVE-2025-26416
github.com/advisories/GHSA-79r8-3f9p-3m46
security-tracker.debian.org/tracker/CVE-2025-26416
suse.com/support/update/announcement/2026/suse-su-202624225-1
Show 194 moreShow less
bugzilla.suse.com/1275791
This page doesn't list everything
Left out here: 144 versions, 76 references and the rest of 4 source descriptions. The JSON record has them.