{"schemaVersion":3,"id":"SUSE-SU-2026:2376-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for webkit2gtk3\n\nThis update for webkit2gtk3 fixes the following issues\n\nUpdate to version 2.52.4:\n\nSecurity fixes:\n\n- CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code\n  execution due to a heap buffer overflow (bsc#1267506).\n- CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after-\n  free issue (bsc#1267507).\n- CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper\n  memory handling (bsc#1267508).\n- CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper\n  memory handling (bsc#1267509).\n- CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper\n  memory handling (bsc#1267510).\n- CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper\n  memory handling (bsc#1267511).\n- CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper\n  memory handling (bsc#1267512).\n- CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due\n  to improper input validation (bsc#1267513).\n- CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free\n  (bsc#1267514).\n- CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free\n  (bsc#1267515).\n- CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free\n  (bsc#1267516).\n- CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper\n  memory handling (bsc#1267517).\n- CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper\n  memory handling (bsc#1267518).\n- CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519).\n- CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due to improper memory\n  handling (bsc#1267520).\n- CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due\n  to issues with logic (bsc#1267521).\n\nOther fixes:\n\n- Add patch to fix a crash on evolution (bsc#1264745).\n\nChanges:\n\n + Add support for half-width fonts.\n + Improve content filter compilation by avoiding file copies.\n + Improve handling of out of disk space conditions when the\n NetworkProcess tried to write data in caches.\n + Improve how the CMake build system checks whether libatomic is\n required.\n + Fix painting scrollbars when their width changes.\n + Fix playback of certain YouTube videos with low frame rates.\n + Fix webkit://gpu not working in systems where neither\n libGL.so.1 nor libOpenGL.so.0 are available.\n + Fix the build with librice 0.4 or newer when the GStreamer\n WebRTC backend is enabled at build configuration time.\n + Fix the build with USE_GSTREAMER_WEBRTC=OFF.\n + Fix the build with USE_GBM=OFF.\n + Fix several crashes and rendering issues.\n + Add support for the 'scrollbar-color' CSS property.\n + Fix some emoji glyphs being rendered as missing glyph boxes.\n + Fix JavaScriptCore crashes on architectures other than x86_64.\n + Fix the build on s390x.\n + Changes in version 2.52.2:\n + Improve handling of real-time threads.\n + Fix scrollbar rendering glitches visible in some GPU\n configurations.\n + Fix V4L2 hardware accelerated media codecs now working due to\n overly restrictive sandbox device access rules.\n + Fix leak of bitmap images in\n webkit_favicon_database_get_favicon_finish().\n + Fix the build with USE_GTK4=OFF.","dates":{"published":"2026-06-11T16:07:25.000Z","modified":"2026-06-12T08:45:07.127Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"webkit2gtk3-soup2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","name":"webkit2gtk3-soup2","label":"webkit2gtk3-soup2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk3-soup2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk3-soup2&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"webkit2gtk3-soup2","label":"webkit2gtk3-soup2&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk3-soup2&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk3-soup2&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"webkit2gtk3-soup2","label":"webkit2gtk3-soup2&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk3-soup2&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk3&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7","name":"webkit2gtk3","label":"webkit2gtk3&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk3&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"webkit2gtk3","label":"webkit2gtk3&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk3&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"webkit2gtk3","label":"webkit2gtk3&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk3&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk4&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","name":"webkit2gtk4","label":"webkit2gtk4&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk4&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk4&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","name":"webkit2gtk4","label":"webkit2gtk4&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk4&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk4&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"webkit2gtk4","label":"webkit2gtk4&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk4&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null},{"vendor":"suse","product":"webkit2gtk4&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"webkit2gtk4","label":"webkit2gtk4&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/webkit2gtk4&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 2.52.4-150600.12.68.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.52.4-150600.12.68.1","eol":null,"hubHref":null}],"affectedCount":10,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262376-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262376-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1264745","label":"bugzilla.suse.com/1264745","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267506","label":"bugzilla.suse.com/1267506","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267507","label":"bugzilla.suse.com/1267507","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267508","label":"bugzilla.suse.com/1267508","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267509","label":"bugzilla.suse.com/1267509","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267510","label":"bugzilla.suse.com/1267510","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267511","label":"bugzilla.suse.com/1267511","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267512","label":"bugzilla.suse.com/1267512","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267513","label":"bugzilla.suse.com/1267513","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267514","label":"bugzilla.suse.com/1267514","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267515","label":"bugzilla.suse.com/1267515","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267516","label":"bugzilla.suse.com/1267516","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267517","label":"bugzilla.suse.com/1267517","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267518","label":"bugzilla.suse.com/1267518","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267519","label":"bugzilla.suse.com/1267519","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267520","label":"bugzilla.suse.com/1267520","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267521","label":"bugzilla.suse.com/1267521","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28847","label":"www.suse.com/security/cve/CVE-2026-28847","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28883","label":"www.suse.com/security/cve/CVE-2026-28883","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28901","label":"www.suse.com/security/cve/CVE-2026-28901","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28902","label":"www.suse.com/security/cve/CVE-2026-28902","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28903","label":"www.suse.com/security/cve/CVE-2026-28903","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28904","label":"www.suse.com/security/cve/CVE-2026-28904","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28905","label":"www.suse.com/security/cve/CVE-2026-28905","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28907","label":"www.suse.com/security/cve/CVE-2026-28907","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28942","label":"www.suse.com/security/cve/CVE-2026-28942","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28946","label":"www.suse.com/security/cve/CVE-2026-28946","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28947","label":"www.suse.com/security/cve/CVE-2026-28947","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28953","label":"www.suse.com/security/cve/CVE-2026-28953","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28955","label":"www.suse.com/security/cve/CVE-2026-28955","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28958","label":"www.suse.com/security/cve/CVE-2026-28958","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43658","label":"www.suse.com/security/cve/CVE-2026-43658","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43660","label":"www.suse.com/security/cve/CVE-2026-43660","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-28847","CVE-2026-28883","CVE-2026-28901","CVE-2026-28902","CVE-2026-28903","CVE-2026-28904","CVE-2026-28905","CVE-2026-28907","CVE-2026-28942","CVE-2026-28946","CVE-2026-28947","CVE-2026-28953","CVE-2026-28955","CVE-2026-28958","CVE-2026-43658","CVE-2026-43660"],"downstream":[],"duplicates":[],"related":["CVE-2026-28847","CVE-2026-28883","CVE-2026-28901","CVE-2026-28902","CVE-2026-28903","CVE-2026-28904","CVE-2026-28905","CVE-2026-28907","CVE-2026-28942","CVE-2026-28946","CVE-2026-28947","CVE-2026-28953","CVE-2026-28955","CVE-2026-28958","CVE-2026-43658","CVE-2026-43660"]},"timeline":[{"kind":"published","date":"2026-06-11T16:07:25.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-12T08:45:07.127Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T19:00:51.955Z","stale":false,"partial":false}}