SUSE-SU-2026:4676-1

This update for webkit2gtk3 fixes the following issues:

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619):

• CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-43091: Out of bounds write due to an integer overflow in filterMask of SkEmbossMaskFilter.cpp could lead to remote code execution.
• CVE-2024-43097: Out of bounds write due to an integer overflow in resizeToAtLeast of SkRegion.cpp could lead to local escalation of privilege.
• CVE-2024-43767: Heap overflow due to improper input validation in prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp could lead to remote code execution.
• CVE-2024-43768: Out of bounds write due to an integer overflow in skia_alloc_func of SkDeflate.cpp could lead to local escalation of privilege.
• CVE-2024-7966: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
• CVE-2024-8193: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8198: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-8636: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2024-9123: Integer overflow in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
• CVE-2025-0436: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-0444: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2025-10502: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via malicious network traffic.
• CVE-2025-26416: Out of bounds write due to a heap buffer overflow in initializeSwizzler of SkBmpStandardCodec.cpp could lead to remote escalation of privilege.
• CVE-2025-32318: Out of bounds write due to a heap buffer overflow in Skia could lead to remote escalation of privilege.
• CVE-2025-48622: Out of bounds read due to a buffer overflow in ProcessArea of dng_misc_opcodes.cpp could lead to local information disclosure.
• CVE-2025-54627: An out-of-bounds write vulnerability in the skia module may affect service confidentiality upon successful exploitation.
• CVE-2025-8901: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2025-9478: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-0908: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10009: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10011: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10012: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10018: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-10019: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-10881: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10883: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10889: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10907: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-10919: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10941: Out of bounds memory access in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-10974: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-10977: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-10979: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-10985: Out of bounds read in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-10993: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-10994: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-11004: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-11024: Stack buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page.
• CVE-2026-11039: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-11040: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-11051: Out of bounds read in ANGLE in Google Chrome on Linux allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-11057: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-11061: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-11065: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-11066: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-11087: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-11088: Integer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-11090: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-11104: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-11109: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-11110: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-11111: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
• CVE-2026-11113: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-11121: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-11123: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-11124: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-11137: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-11138: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-11159: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-11191: Out of bounds memory access in ANGLE in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
• CVE-2026-11663: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-11675: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-13780: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-13781: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-13834: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-13841: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-13859: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-13877: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-13883: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-13971: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-14044: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14125: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-14152: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14382: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14386: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-14387: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14388: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-14389: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14390: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14396: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-14398: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14400: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14410: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.
• CVE-2026-14411: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14412: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14413: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14414: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-14418: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-14419: Use after free in Skia in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14425: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14427: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-14429: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-15109: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-15766: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-15774: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-16413: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-16417: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-17653: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17655: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17667: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-17668: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-17671: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17675: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17678: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17682: Integer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17683: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-17687: Type Confusion in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17689: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-17697: Type Confusion in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17702: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-17704: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17714: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-17717: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17718: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17721: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17740: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-17745: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17750: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17757: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-17771: Uninitialized Use in Skia in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-17785: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-17801: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17832: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17847: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-17914: Side-channel information leakage in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-19160: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-19161: Uninitialized Use in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-19173: Out of bounds write in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-19176: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-3536: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
• CVE-2026-3538: Integer overflow in Skia in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
• CVE-2026-3909: Out of bounds write in Skia in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2026-3931: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
• CVE-2026-43670: A Content Security Policy bypass in AudioWorklet contexts that allowed processing maliciously crafted web content was addressed with improved enforcement.
• CVE-2026-4448: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-4460: Out of bounds read in Skia in Google Chrome allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
• CVE-2026-4464: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-5283: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-5870: Integer overflow in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-6296: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-6298: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-6364: Out of bounds read in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file.
• CVE-2026-64715: A use-after-free issue that may lead to an unexpected process crash when processing maliciously crafted web content was addressed with improved memory management.
• CVE-2026-64753: A permissions issue that may disclose sensitive user information when processing maliciously crafted web content was addressed by removing the vulnerable code.
• CVE-2026-64778: A vulnerability that may leak sensitive data when visiting a maliciously crafted website was addressed with improved checks.
• CVE-2026-64779: A memory corruption vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved locking.
• CVE-2026-64780: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved checks.
• CVE-2026-64781: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved input validation.
• CVE-2026-64782: A memory corruption vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved locking.
• CVE-2026-64784: An out-of-bounds access issue that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved bounds checking.
• CVE-2026-65331: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management.
• CVE-2026-65332: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management.
• CVE-2026-65333: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management.
• CVE-2026-65334: A memory corruption issue that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved state management.
• CVE-2026-65336: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management.
• CVE-2026-65337: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management.
• CVE-2026-65338: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed with improved memory handling.
• CVE-2026-65340: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management.
• CVE-2026-65341: A vulnerability that may lead to memory corruption when processing maliciously crafted web content was addressed with improved memory handling.
• CVE-2026-65351: A vulnerability that may lead to an unexpected crash when processing maliciously crafted web content was addressed through improved state management.
• CVE-2026-7353: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-7354: Out of bounds read and write in Angle in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-7359: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-76041: Information leak in Skia in Google Chrome allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page.
• CVE-2026-78904: Type confusion in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-78905: Type confusion in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-78906: Race condition in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-78914: Uninitialized resource in Skia in Google Chrome allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.
• CVE-2026-78958: Uninitialized resource in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page.
• CVE-2026-78965: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
• CVE-2026-7900: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-79020: Out of bounds read in Skia in Google Chrome allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file.
• CVE-2026-79043: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-79112: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page.
• CVE-2026-79118: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
• CVE-2026-79120: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page.
• CVE-2026-79127: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-79130: Buffer overflow in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-79131: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-79144: Information leak in Skia in Google Chrome allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
• CVE-2026-79147: Information leak in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page.
• CVE-2026-79149: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-79188: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-79189: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-7920: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-79229: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.
• CVE-2026-7923: Out of bounds write in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-79269: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page.
• CVE-2026-79270: Uninitialized resource in ANGLE in Google Chrome allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.
• CVE-2026-79275: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
• CVE-2026-7942: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-7943: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page.
• CVE-2026-7949: Out of bounds read in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted Chrome Extension.
• CVE-2026-84635: A logic issue that may lead to an unexpected process termination when processing maliciously crafted web content was addressed with improved state management.
• CVE-2026-8579: Insufficient validation of untrusted input in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted print file.
• CVE-2026-86898: A logic issue that may lead to universal cross-site scripting when opening a maliciously crafted webarchive file was addressed with improved state management.
• CVE-2026-9877: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9878: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-9879: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code via a crafted HTML page.
• CVE-2026-9882: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-9893: Use after free in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9899: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9900: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9901: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.
• CVE-2026-9904: Use after free in ANGLE in Google Chrome allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9908: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-9909: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-9910: Out of bounds memory access in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-9911: Integer overflow in ANGLE in Google Chrome allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
• CVE-2026-9913: Inappropriate implementation in ANGLE in Google Chrome allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
• CVE-2026-9914: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9915: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9916: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9923: Use after free in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-9925: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9926: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9927: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-9935: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.
• CVE-2026-9940: Heap buffer overflow in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-9941: Use after free in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-9942: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
• CVE-2026-9944: Uninitialized Use in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
• CVE-2026-9946: Use after free in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9953: Out of bounds read in ANGLE in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-9965: Out of bounds write in ANGLE in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
• CVE-2026-9969: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker to execute arbitrary code via a crafted HTML page.
• CVE-2026-9975: Out of bounds read and write in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9981: Inappropriate implementation in Skia in Google Chrome allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
• CVE-2026-9982: Insufficient validation of untrusted input in ANGLE in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
• CVE-2026-9983: Type Confusion in Skia in Google Chrome allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
• CVE-2026-9998: Integer overflow in Skia in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Changes for webkit2gtk3:

• Update to version 2.54.1