CVE-2026-79020

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

• chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)

• chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)

• chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)

• chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)

• chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)

• webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)

• webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)

• webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)

• webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)

• webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)

• chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)

• webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)

• webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)

• webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)

• chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)

• webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)

• webkitgtk: Processing maliciously crafted web…

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

• chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860)

• chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532)

• chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966)

• chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193)

• chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198)

• chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636)

• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123)

• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436)

• chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444)

• chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability (CVE-2025-8901)

• chromium-browser: angle: Use after free in ANGLE (CVE-2025-9478)

• chromium-browser: angle: Heap buffer overflow in ANGLE (CVE-2025-10502)

• chromium-browser: angle: Use after free in ANGLE (CVE-2026-0908)

• chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-3536)

• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-3538)

• chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-3931)

• chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-3909)

• chromium-browser: Integer overflow in ANGLE (CVE-2026-4464)

• chromium-browser: Integer overflow in ANGLE (CVE-2026-4452)

• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-4448)

• chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-4460)

• chromium-browser: Inappropriate implementation in ANGLE (CVE-2026-5283)

• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5275)

• chromium-browser: Integer overflow in ANGLE (CVE-2026-5277)

• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5868)

• chromium-browser: Insufficient validation of untrusted input in ANGLE (CVE-2026-5879)

• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-5870)

• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-6296)

• chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-6364)

• chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-6298)

• chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-7353)

• chromium-browser: Integer overflow in ANGLE (CVE-2026-7340)

• chromium-browser: Use after free in ANGLE (CVE-2026-7359)

• chromium-browser: Out of bounds read and write in Angle (CVE-2026-7354)

• chromium-browser: Use after free in ANGLE (CVE-2026-7901)

• chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-7949)

• chromium-browser: Integer overflow in ANGLE (CVE-2026-7903)

• chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-7923)

• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-7900)

• chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-7920)

• chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-7942)

• chromium-browser: angle: Insufficient validation of untrusted input in ANGLE (CVE-2026-7943)

• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-8510)

• chromium-browser: angle: chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-8525)

• chromium-browser: angle: chromium-browser: Type Confusion in ANGLE (CVE-2026-8554)

• chromium-browser: chromium-browser: Inappropriate implementation in ANGLE…

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

• chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
• chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
• chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
• chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
• chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
• webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
• webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
• webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
• webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
• webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
• chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
• webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
• webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
• webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
• chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
• webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635) *…

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

• chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860)
• chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532)
• chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966)
• chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193)
• chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198)
• chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636)
• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123)
• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436)
• chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444)
• chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability (CVE-2025-8901)
• chromium-browser: angle: Use after free in ANGLE (CVE-2025-9478)
• chromium-browser: angle: Heap buffer overflow in ANGLE (CVE-2025-10502)
• chromium-browser: angle: Use after free in ANGLE (CVE-2026-0908)
• chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-3536)
• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-3538)
• chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-3931)
• chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-3909)
• chromium-browser: Integer overflow in ANGLE (CVE-2026-4464)
• chromium-browser: Integer overflow in ANGLE (CVE-2026-4452)
• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-4448)
• chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-4460)
• chromium-browser: Inappropriate implementation in ANGLE (CVE-2026-5283)
• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5275)
• chromium-browser: Integer overflow in ANGLE (CVE-2026-5277)
• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-5868)
• chromium-browser: Insufficient validation of untrusted input in ANGLE (CVE-2026-5879)
• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-5870)
• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-6296)
• chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-6364)
• chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-6298)
• chromium-browser: skia: chromium-browser: skia: Heap buffer overflow in Skia (CVE-2026-7353)
• chromium-browser: Integer overflow in ANGLE (CVE-2026-7340)
• chromium-browser: Use after free in ANGLE (CVE-2026-7359)
• chromium-browser: Out of bounds read and write in Angle (CVE-2026-7354)
• chromium-browser: Use after free in ANGLE (CVE-2026-7901)
• chromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-7949)
• chromium-browser: Integer overflow in ANGLE (CVE-2026-7903)
• chromium-browser: skia: chromium-browser: skia: Out of bounds write in Skia (CVE-2026-7923)
• chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-7900)
• chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-7920)
• chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-7942)
• chromium-browser: angle: Insufficient validation of untrusted input in ANGLE (CVE-2026-7943)
• chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2026-8510)
• chromium-browser: angle: chromium-browser: Heap buffer overflow in ANGLE (CVE-2026-8525)
• chromium-browser: angle: chromium-browser: Type Confusion in ANGLE (CVE-2026-8554)
• chromium-browser:…

• Rebase to webkitgtk 2.54.0 (WebKitGTK Security Advisory WSA-2026-0006), aligning with the release RHEL 9 ships (webkit2gtk3-2.54.0-1.el9_8, RHSA-2026:69098).
• Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from c9s 2.54.0-2 and reverts 317619@main, which aborts Eclipse/SWT applications on a RELEASE_ASSERT in initializeMainThread.
• Drop fix-renderflexbox-typename.patch (was Patch17); the code it patched is gone on 2.54.0.
• Build with gcc-toolset-14 (GCC 14) instead of gcc-toolset-12; GCC 12 cannot compile 2.54.0 (ANGLE ResourceMap static_assert, LayoutRect constexpr).
• Backport the GStreamerCommon.h <WebCore/GraphicsTypesGL.h> include from upstream 2.54.1; GCC resolves the symlinked WebCore private headers to their real path, so the quoted include is not found when building the PCH.
• Drop the vendored Skia backports for CVE-2026-5870, CVE-2026-7920, CVE-2026-7923, CVE-2026-10009 and CVE-2026-11663 (was Patch20..Patch24); the Skia snapshot bundled with 2.54.0 already includes them.
• CVEs resolved by this rebase (62 total): CVE-2026-3538, CVE-2026-3909, CVE-2026-4460, CVE-2026-6298, CVE-2026-6364, CVE-2026-7353, CVE-2026-7949, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983, CVE-2026-9998, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985, CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099, CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11675, CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-2026-14427, CVE-2026-15766, CVE-2026-16417, CVE-2026-17702, CVE-2026-17745, CVE-2026-17757, CVE-2026-17914, CVE-2026-19160, CVE-2026-19161, CVE-2026-19176, CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64753, CVE-2026-64757, CVE-2026-64778, CVE-2026-64779, CVE-2026-64782, CVE-2026-64783, CVE-2026-64784, CVE-2026-65332, CVE-2026-65336, CVE-2026-65337, CVE-2026-65341, CVE-2026-65351, CVE-2026-76041, CVE-2026-78376, CVE-2026-78914, CVE-2026-79020, CVE-2026-79112, CVE-2026-79144, CVE-2026-79147, CVE-2026-83596, CVE-2026-84359, CVE-2026-84635, CVE-2026-85049

These are all security issues fixed in the chromedriver-152.0.7977.64-1.1 package on the GA media of openSUSE Tumbleweed.

This update for chromium fixes the following issues:

Changes in chromium:

• Chromium 152.0.7977.64 (boo#1276749, stable released 2026-08-25):
  • CVE-2026-79282: Use after free in ANGLE
  • CVE-2026-79290: Use after free in Aura
  • CVE-2026-79054: Use after free in Chromecast
  • CVE-2026-79121: Improper input validation in Chromecast
  • CVE-2026-79224: Use after free in Chromecast
  • CVE-2026-79052: Use after free in Aura
  • CVE-2026-79150: Use after free in Views
  • CVE-2026-78935: Use of uninitialized variable in Mobile
  • CVE-2026-79012: Use after free in Safebrowsing
  • CVE-2026-79200: Use after free in Aura
  • CVE-2026-78989: Out of bounds read in ANGLE
  • CVE-2026-79069: Memory corruption in Tint
  • CVE-2026-79175: Type confusion in Accessibility
  • CVE-2026-79218: Incorrect authorization in Sandbox
  • CVE-2026-79195: Use after free in Script
  • CVE-2026-78939: Use after free in Chromecast
  • CVE-2026-79194: Use after free in Chromoting
  • CVE-2026-79247: Use after free in Chromoting
  • CVE-2026-79219: Use after free in Bluetooth
  • CVE-2026-79047: Use after free in Views
  • CVE-2026-79292: Integer overflow in Chromecast
  • CVE-2026-78986: Uninitialized resource in GPU
  • CVE-2026-79039: Use after free in Mobile
  • CVE-2026-78934: Race condition in ReadAloud
  • CVE-2026-79011: UI misrepresentation in Browser
  • CVE-2026-78911: Incorrect authorization in USB
  • CVE-2026-79257: Use after free in Views
  • CVE-2026-79202: Use after free in Chromecast
  • CVE-2026-79212: Missing authorization in Passwords
  • CVE-2026-79183: Use after free in Accessibility
  • CVE-2026-79155: Race condition in FileSystem
  • CVE-2026-79093: Incorrect authorization in Paint
  • CVE-2026-79019: Out of bounds write in ANGLE
  • CVE-2026-79187: Use after free in WebRTC
  • CVE-2026-79288: Improper input validation in Autofill
  • CVE-2026-79130: Buffer overflow in ANGLE
  • CVE-2026-78965: Uninitialized resource in ANGLE
  • CVE-2026-79117: Race condition in WebAppInstalls
  • CVE-2026-79082: Incorrect authorization in Transactions Platform
  • CVE-2026-79111: Improper input validation in Dawn
  • CVE-2026-79072: Improper state validation in Performance
  • CVE-2026-79142: Buffer overflow in ANGLE
  • CVE-2026-78948: Buffer overflow in WebGL
  • CVE-2026-78908: Information leak in Canvas
  • CVE-2026-78895: Information leak in Paint
  • CVE-2026-79043: Out of bounds write in ANGLE
  • CVE-2026-79235: Use after free in WebGL
  • CVE-2026-79232: Use after free in Aura
  • CVE-2026-79118: Uninitialized resource in ANGLE
  • CVE-2026-79174: Incorrect authorization in Extensions
  • CVE-2026-78900: Improper input validation in Media
  • CVE-2026-79188: Out of bounds write in ANGLE
  • CVE-2026-79189: Out of bounds write in ANGLE
  • CVE-2026-79048: Out of bounds write in ANGLE
  • CVE-2026-79240: Out of bounds write in ANGLE
  • CVE-2026-79014: Race condition in Autofill
  • CVE-2026-79198: Use after free in Platform
  • CVE-2026-79131: Out of bounds write in ANGLE
  • CVE-2026-79149: Use after free in ANGLE
  • CVE-2026-79275: Use after free in ANGLE
  • CVE-2026-79138: Out of bounds write in ANGLE
  • CVE-2026-79026: Use after free in Extensions
  • CVE-2026-79027: Use after free in WebRTC
  • CVE-2026-78904: Type confusion in ANGLE
  • CVE-2026-78899: Use after free in V8
  • CVE-2026-78954: Incorrect authorization in Extensions
  • CVE-2026-79274: Information leak in GPU
  • CVE-2026-78938: Type confusion in V8
  • CVE-2026-78952: Out of bounds write in Crashpad
  • CVE-2026-79236: Type confusion in V8
  • CVE-2026-79078: Use after free in FedCM
  • CVE-2026-79209: Type confusion in Animation
  • CVE-2026-79030: Observable discrepancy in Autofill
  • CVE-2026-79216: Buffer overflow in Blink
  • CVE-2026-79007: Uninitialized resource in GPU
  • CVE-2026-78893: Information leak in QUIC
  • CVE-2026-79222: Incorrect authorization in CustomTabs
  • CVE-2026-79071: Race condition in GPU
  • CVE-2026-79076: Improper input…

This update for chromium fixes the following issues:

Changes in chromium:

• Chromium 152.0.7977.82 (boo#1278683):

  • CVE-2026-85046: Type confusion in V8
  • CVE-2026-85052: Out of bounds read in CrashReporting
  • CVE-2026-85043: Incomplete cleanup in Network
  • CVE-2026-85048: Use after free in Compositing
  • CVE-2026-85045: Race condition in V8
  • CVE-2026-85050: Out of bounds write in WebGL
  • CVE-2026-85053: Improper resource exposure in CacheStorage
  • CVE-2026-85042: Use after free in DevTools
  • CVE-2026-85049: Use after free in Skia
  • CVE-2026-85051: Type confusion in Compositing
  • CVE-2026-85047: Improper input validation in Transactions Platform
  • CVE-2026-85044: Use of released resource in Mobile

• Chromium 152.0.7977.75 (boo#1278072):

  • CVE-2026-84353: Use after free in Shared Tab Groups
  • CVE-2026-84352: Use after free in WebGL
  • CVE-2026-84354: Incorrect authorization in FileSystem
  • CVE-2026-84359: Information leak in Skia
  • CVE-2026-84357: Improper input validation in Omnibox
  • CVE-2026-84324: Use after free in Proxy
  • CVE-2026-84349: Use after free in Browser
  • CVE-2026-84326: Uninitialized resource in V8
  • CVE-2026-84333: Use after free in Dawn
  • CVE-2026-84351: Buffer overflow in GPU
  • CVE-2026-84325: Improper input validation in DataTransfer
  • CVE-2026-84328: Missing authorization in FileSystem
  • CVE-2026-84347: Use after free in WebRTC
  • CVE-2026-84323: Missing authorization in FileSystem
  • CVE-2026-84355: Incorrect authorization in Navigation
  • CVE-2026-84358: Improper privilege management in Downloads
  • CVE-2026-84332: Incorrect authorization in SiteSettings
  • CVE-2026-84330: UI misrepresentation in FullScreen
  • CVE-2026-84334: Incorrect authorization in Chromoting
  • CVE-2026-84348: Information leak in MediaCapture
  • CVE-2026-84335: Incorrect authorization in TabStrip
  • CVE-2026-84327: Incorrect authorization in Autofill
  • CVE-2026-84329: Confused deputy in CredentialProvider
  • CVE-2026-84356: UI misrepresentation in FullScreen
  • CVE-2026-84350: Use after free in TabStrip
  • CVE-2026-84331: Incorrect authorization in Actor

• Disabled EULA dialog to use preferences instead of a hardcoded return

• Chromium 152.0.7977.64 (boo#1276749, stable released 2026-08-25):

  • CVE-2026-79282: Use after free in ANGLE
  • CVE-2026-79290: Use after free in Aura
  • CVE-2026-79054: Use after free in Chromecast
  • CVE-2026-79121: Improper input validation in Chromecast
  • CVE-2026-79224: Use after free in Chromecast
  • CVE-2026-79052: Use after free in Aura
  • CVE-2026-79150: Use after free in Views
  • CVE-2026-78935: Use of uninitialized variable in Mobile
  • CVE-2026-79012: Use after free in Safebrowsing
  • CVE-2026-79200: Use after free in Aura
  • CVE-2026-78989: Out of bounds read in ANGLE
  • CVE-2026-79069: Memory corruption in Tint
  • CVE-2026-79175: Type confusion in Accessibility
  • CVE-2026-79218: Incorrect authorization in Sandbox
  • CVE-2026-79195: Use after free in Script
  • CVE-2026-78939: Use after free in Chromecast
  • CVE-2026-79194: Use after free in Chromoting
  • CVE-2026-79247: Use after free in Chromoting
  • CVE-2026-79219: Use after free in Bluetooth
  • CVE-2026-79047: Use after free in Views
  • CVE-2026-79292: Integer overflow in Chromecast
  • CVE-2026-78986: Uninitialized resource in GPU
  • CVE-2026-79039: Use after free in Mobile
  • CVE-2026-78934: Race condition in ReadAloud
  • CVE-2026-79011: UI misrepresentation in Browser
  • CVE-2026-78911: Incorrect authorization in USB
  • CVE-2026-79257: Use after free in Views
  • CVE-2026-79202: Use after free in Chromecast
  • CVE-2026-79212: Missing authorization in Passwords
  • CVE-2026-79183: Use after free in Accessibility
  • CVE-2026-79155: Race condition in FileSystem
  • CVE-2026-79093: Incorrect authorization in Paint
  • CVE-2026-79019: Out of bounds write in ANGLE
  • CVE-2026-79187: Use after free in WebRTC
  • CVE-2026-79288: Improper input…

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

Root has patched CVE-2026-79020 in the webkit2gtk package for Root:Debian:13. Multiple fixed versions available.

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. -…

This update for webkit2gtk3 fixes the following issues:

Security issues fixed:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a…