CVE-2026-28871
Description
Important: webkit2gtk3 security update
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack Red Hat statement To exploit this flaw, an attacker needs to trick a user into visiting a maliciously crafted web page. Due to this reason, this flaw has been rated with a moderate severity. CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Errata / fixed releases…
Description
webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack
Red Hat statement
To exploit this flaw, an attacker needs to trick a user into visiting a maliciously crafted web page. Due to this reason, this flaw has been rated with a moderate severity.
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | webkit2gtk3-0:2.52.3-1.el8_10 | RHSA-2026:10702 | 2026-04-27T00:00:00Z |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | webkit2gtk3-0:2.52.3-1.el8_4 | RHSA-2026:16056 | 2026-05-11T00:00:00Z |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | webkit2gtk3-0:2.52.3-1.el8_4 | RHSA-2026:16056 | 2026-05-11T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | webkit2gtk3-0:2.52.3-1.el8_6 | RHSA-2026:13845 | 2026-05-05T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | webkit2gtk3-0:2.52.3-1.el8_6 | RHSA-2026:13845 | 2026-05-05T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | webkit2gtk3-0:2.52.3-1.el8_6 | RHSA-2026:13845 | 2026-05-05T00:00:00Z |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | webkit2gtk3-0:2.52.3-1.el8_8 | RHSA-2026:11814 | 2026-04-29T00:00:00Z |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | webkit2gtk3-0:2.52.3-1.el8_8 | RHSA-2026:11814 | 2026-04-29T00:00:00Z |
| Red Hat Enterprise Linux 9 | webkit2gtk3-0:2.52.3-1.el9_8 | RHSA-2026:19206 | 2026-05-19T00:00:00Z |
| Red Hat Enterprise Linux 9 | webkit2gtk3-0:2.52.3-0.el9_7.1 | RHSA-2026:9692 | 2026-04-22T00:00:00Z |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | webkit2gtk3-0:2.52.3-1.el9_0 | RHSA-2026:19535 | 2026-05-20T00:00:00Z |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | webkit2gtk3-0:2.52.3-1.el9_2 | RHSA-2026:16695 | 2026-05-13T00:00:00Z |
| Red Hat Enterprise Linux 9.4 Extended Update Support | webkit2gtk3-0:2.52.3-1.el9_4 | RHSA-2026:14659 | 2026-05-07T00:00:00Z |
| Red Hat Enterprise Linux 9.6 Extended Update Support | webkit2gtk3-0:2.52.3-1.el9_6 | RHSA-2026:11329 | 2026-04-28T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | webkitgtk | Out of support scope |
| Red Hat Enterprise Linux 7 | webkitgtk3 | Not affected |
| Red Hat Enterprise Linux 7 | webkitgtk4 | Affected |
Apply commands
yum update -y webkit2gtk3
# or:
dnf upgrade -y webkit2gtk3Affected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat Enterprise Linux 7 | Not affected |
| redhat | Red Hat Enterprise Linux 7 | Affected |
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| sles | affected | | |
| debian | bookworm | affected | |
| debian | bullseye | affected | |
| debian | forky | fixed | 2.52.1-1 |
| debian | sid | fixed | 2.52.1-1 |
| debian | trixie | fixed | 2.52.3-2~deb13u1 |
| rocky | 9 | fixed | |
References
- https://access.redhat.com/errata/RHSA-2026:19206
- https://access.redhat.com/errata/RHSA-2026:9692
- https://www.suse.com/security/cve/CVE-2026-28871.html
- https://security-tracker.debian.org/tracker/CVE-2026-28871
- https://access.redhat.com/errata/RHSA-2026:10702
- https://bugzilla.redhat.com/2448781
- https://bugzilla.redhat.com/2448782
- https://bugzilla.redhat.com/2448786
- https://bugzilla.redhat.com/2448787
- https://bugzilla.redhat.com/2448788
- https://bugzilla.redhat.com/2448789
- https://bugzilla.redhat.com/2448790
- https://bugzilla.redhat.com/2448791
- https://bugzilla.redhat.com/2448792
- https://bugzilla.redhat.com/2448793
- https://bugzilla.redhat.com/2448794
- https://bugzilla.redhat.com/2453000
- https://bugzilla.redhat.com/2453001
- https://bugzilla.redhat.com/2453002
- https://bugzilla.redhat.com/2453003
- https://bugzilla.redhat.com/2453004
- https://bugzilla.redhat.com/2453006
- https://bugzilla.redhat.com/2453008
- https://errata.almalinux.org/8/ALSA-2026-10702.html
- https://errata.almalinux.org/9/ALSA-2026-19206.html
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.