RHSA-2026:95589
Vulnerability from csaf_redhat - Published: 2026-11-05 16:35 - Updated: 2026-11-06 07:28Summary
Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update
Severity
Critical
Notes
Topic: An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read (CVE-2026-87596)
* chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page (CVE-2026-87500)
* chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE (CVE-2026-87654)
* chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability (CVE-2026-87621)
* chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnerability in ANGLE (CVE-2026-87512)
* chromium-browser: angle: ANGLE: Arbitrary code execution in Google Chrome due to use-after-free (CVE-2026-87648)
* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87602)
* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87586)
* chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via out-of-bounds read (CVE-2026-87604)
* chromium-browser: angle: chromium-browser: Improper input validation in ANGLE (CVE-2026-91738)
* chromium-browser: angle: chromium-browser: Uninitialized resource in ANGLE (CVE-2026-91720)
Bug Fix(es) and Enhancement(s):
* webkit2gtk3 2.54.0 regression breaks Eclipse IDE WebKit-based views on CentOS Stream 8 (JIRA:RHEL-299543)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation can occur when a user visits a specially crafted HTML page. This could lead to a complete compromise of the affected system.
9.6 (Critical)
Affected products
Fixed
38 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Critical
A flaw was found in chromium-browser. A use-after-free vulnerability in ANGLE allows a remote attacker to execute arbitrary code outside the sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page, leading to a complete compromise of the affected system.
9.6 (Critical)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Critical
A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser's security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the unauthorized disclosure of sensitive information.
7.4 (High)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Important
A flaw was found in ANGLE, a component of Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to read sensitive memory outside of the browser's security sandbox, leading to information disclosure.
7.4 (High)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Important
A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to read memory outside of the browser's security sandbox, leading to information disclosure.
4.3 (Medium)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Moderate
A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability could allow a remote attacker, who has already compromised the browser's renderer process, to potentially execute arbitrary code outside of the browser's security sandbox. This exploitation occurs when a user visits a specially crafted HTML page.
9.0 (Critical)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Important
A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds write vulnerability allows a remote attacker to potentially execute arbitrary code. By tricking a user into visiting a specially crafted HTML page, an attacker could bypass the browser's security sandbox and execute malicious code on the system.
9.6 (Critical)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Critical
A flaw was found in ANGLE, a component of Google Chrome. A remote attacker who has compromised the renderer process could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code outside of the sandbox, leading to a compromise of the system.
9.0 (Critical)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Important
A flaw was found in Chromium's ANGLE component. A remote attacker could exploit a buffer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to the execution of arbitrary code outside the browser's security sandbox, potentially compromising the affected system.
9.6 (Critical)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Critical
An uninitialized resource flaw was found in the ANGLE component of the Chromium browser. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=523470135
7.4 (High)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Important
An improper input validation flaw was found in the ANGLE component of the Chromium browser. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=536450979
9.6 (Critical)
Affected products
Fixed
38 products, the same list as for
CVE-2026-87500
Threats
Impact
Important
References
71 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.\n\nSecurity Fix(es):\n\n* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read (CVE-2026-87596)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page (CVE-2026-87500)\n\n* chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE (CVE-2026-87654)\n\n* chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability (CVE-2026-87621)\n\n* chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnerability in ANGLE (CVE-2026-87512)\n\n* chromium-browser: angle: ANGLE: Arbitrary code execution in Google Chrome due to use-after-free (CVE-2026-87648)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87602)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87586)\n\n* chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via out-of-bounds read (CVE-2026-87604)\n\n* chromium-browser: angle: chromium-browser: Improper input validation in ANGLE (CVE-2026-91738)\n\n* chromium-browser: angle: chromium-browser: Uninitialized resource in ANGLE (CVE-2026-91720)\n\nBug Fix(es) and Enhancement(s):\n\n* webkit2gtk3 2.54.0 regression breaks Eclipse IDE WebKit-based views on CentOS Stream 8 (JIRA:RHEL-299543)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95589",
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2530272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530272"
},
{
"category": "external",
"summary": "2530296",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530296"
},
{
"category": "external",
"summary": "2530305",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530305"
},
{
"category": "external",
"summary": "2530333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530333"
},
{
"category": "external",
"summary": "2530389",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530389"
},
{
"category": "external",
"summary": "2530396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530396"
},
{
"category": "external",
"summary": "2530447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530447"
},
{
"category": "external",
"summary": "2530458",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530458"
},
{
"category": "external",
"summary": "2530475",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530475"
},
{
"category": "external",
"summary": "2534404",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534404"
},
{
"category": "external",
"summary": "2534673",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534673"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95589.json"
}
],
"title": "Red Hat Security Advisory: webkit2gtk3 security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-11-06T07:28:50+00:00",
"generator": {
"date": "2026-11-06T07:28:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:95589",
"initial_release_date": "2026-11-05T16:35:58+00:00",
"revision_history": [
{
"date": "2026-11-05T16:35:58+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-05T16:35:58+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T07:28:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_aus:8.6::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.54.1-1.el8_6.src",
"product": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.src",
"product_id": "webkit2gtk3-0:2.54.1-1.el8_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.54.1-1.el8_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.54.1-1.el8_6?arch=i686"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.54.1-1.el8_6?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
},
{
"branches": [
{
"category": "product_version",
"name": "webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debugsource@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-debuginfo@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-devel-debuginfo@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-debuginfo@2.54.1-1.el8_6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_id": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/webkit2gtk3-jsc-devel-debuginfo@2.54.1-1.el8_6?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.54.1-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream AUS (v.8.6)",
"product_id": "AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.AUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.src as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src"
},
"product_reference": "webkit2gtk3-0:2.54.1-1.el8_6.src",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)",
"product_id": "AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
},
"product_reference": "webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"relates_to_product_reference": "AppStream-8.6.0.Z.EUS.EXTENSION"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-87500",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-09T01:03:29.189958+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530296"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser\u0027s security sandbox. Exploitation can occur when a user visits a specially crafted HTML page. This could lead to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Critical because an unauthenticated remote attacker can escape client sandboxing boundaries to achieve arbitrary code execution on the host with user privileges. In Red Hat Enterprise Linux, this flaw primarily impacts desktop environments and applications that embed WebKitGTK for rendering web graphics. Headless server deployments without graphical interfaces or embedded browser components do not expose this attack surface under standard configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87500"
},
{
"category": "external",
"summary": "RHBZ#2530296",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530296"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87500"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87500",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87500"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/540019091",
"url": "https://issues.chromium.org/issues/540019091"
}
],
"release_date": "2026-09-09T00:09:35.411000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page"
},
{
"cve": "CVE-2026-87512",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-09T01:10:35.862685+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530389"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in chromium-browser. A use-after-free vulnerability in ANGLE allows a remote attacker to execute arbitrary code outside the sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page, leading to a complete compromise of the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnerability in ANGLE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Critical because successful exploitation could permit arbitrary command execution that bypasses application sandbox boundaries, potentially compromising the host environment completely. Although upstream advisories indicate this issue specifically targets Windows builds, Red Hat maintains a high severity assessment due to the severe consequences if embedded graphics translation libraries are reached. Exploitation necessitates user interaction, requiring a client to navigate to untrusted, malicious web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87512"
},
{
"category": "external",
"summary": "RHBZ#2530389",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530389"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87512"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/541715128",
"url": "https://issues.chromium.org/issues/541715128"
}
],
"release_date": "2026-09-09T00:09:31.764000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnerability in ANGLE"
},
{
"cve": "CVE-2026-87586",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T01:15:15.509149+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530458"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser\u0027s security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the unauthorized disclosure of sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important for Red Hat Enterprise Linux because an unauthenticated remote adversary can read memory outside isolated sandbox boundaries, posing a high confidentiality threat despite requiring user interaction. On default server installations, Red Hat Enterprise Linux does not include graphical desktop software or WebKit-based rendering components, restricting potential exposure primarily to desktop installations or workstations. Triggering this issue requires an interactive user session to load untrusted web content into an application utilizing the embedded graphics translation engine.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87586"
},
{
"category": "external",
"summary": "RHBZ#2530458",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530458"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87586"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87586",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87586"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/536598187",
"url": "https://issues.chromium.org/issues/536598187"
}
],
"release_date": "2026-09-09T00:09:57.669000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page"
},
{
"cve": "CVE-2026-87596",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T01:02:03.543229+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530272"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ANGLE, a component of Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to read sensitive memory outside of the browser\u0027s security sandbox, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important for Red Hat Enterprise Linux because it permits an unauthenticated remote adversary to bypass process sandbox boundaries and read sensitive host memory, posing a high confidentiality risk without requiring local user privileges. Successful exploitation relies on user interaction, specifically convincing an end user to render malicious graphics or web content within a client application that incorporates the ANGLE translation layer, such as Chromium or WebKitGTK. Server installations operating in headless environments or lacking graphical desktop packages are not exposed to this issue in standard deployment configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87596"
},
{
"category": "external",
"summary": "RHBZ#2530272",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530272"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87596",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87596"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87596",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87596"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/536434693",
"url": "https://issues.chromium.org/issues/536434693"
}
],
"release_date": "2026-09-09T00:09:34.445000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read"
},
{
"cve": "CVE-2026-87602",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T01:14:40.689343+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530447"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds read vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to read memory outside of the browser\u0027s security sandbox, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87602"
},
{
"category": "external",
"summary": "RHBZ#2530447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87602"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/541546782",
"url": "https://issues.chromium.org/issues/541546782"
}
],
"release_date": "2026-09-09T00:10:06.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page"
},
{
"cve": "CVE-2026-87604",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-09T01:16:07.590693+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530475"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability could allow a remote attacker, who has already compromised the browser\u0027s renderer process, to potentially execute arbitrary code outside of the browser\u0027s security sandbox. This exploitation occurs when a user visits a specially crafted HTML page.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via out-of-bounds read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because, although exploiting it requires a pre-existing renderer compromise and victim interaction, an adversary can break out of application sandboxing to achieve arbitrary code execution on the host. In Red Hat Enterprise Linux, affected WebKit rendering components are primarily utilized by graphical desktop applications rather than default headless server workloads. Consequently, exposure is limited to installations where desktop environments are deployed and users process untrusted external web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87604"
},
{
"category": "external",
"summary": "RHBZ#2530475",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530475"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87604"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87604",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87604"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/536648007",
"url": "https://issues.chromium.org/issues/536648007"
}
],
"release_date": "2026-09-09T00:09:34.780000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via out-of-bounds read"
},
{
"cve": "CVE-2026-87621",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-09T01:06:08.695424+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds write vulnerability allows a remote attacker to potentially execute arbitrary code. By tricking a user into visiting a specially crafted HTML page, an attacker could bypass the browser\u0027s security sandbox and execute malicious code on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this vulnerability as Critical because successful exploitation enables a remote, unauthenticated adversary to escape browser sandboxing and achieve arbitrary code execution on the host system. In Red Hat Enterprise Linux, the impacted WebKit rendering libraries are primarily utilized by graphical desktop applications and embedded web viewers rather than headless server services. Consequently, exposure is confined to systems where users actively process untrusted web content or render untrusted HTML within desktop environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87621"
},
{
"category": "external",
"summary": "RHBZ#2530333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87621"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87621",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87621"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/536664909",
"url": "https://issues.chromium.org/issues/536664909"
}
],
"release_date": "2026-09-09T00:09:34.928000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability"
},
{
"cve": "CVE-2026-87648",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-09T01:11:16.567678+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530396"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in ANGLE, a component of Google Chrome. A remote attacker who has compromised the renderer process could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code outside of the sandbox, leading to a compromise of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: ANGLE: Arbitrary code execution in Google Chrome due to use-after-free",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as an Important severity flaw because escaping sandbox containment allows code execution on the underlying host, although it demands an initial compromise of the rendering process. In typical Red Hat Enterprise Linux installations, standard browser packages such as Firefox are unaffected as they do not incorporate the flawed graphics subsystem. Any residual risk in applications utilizing affected web rendering libraries is constrained by user privileges and requires convincing a local user to view hostile web content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87648"
},
{
"category": "external",
"summary": "RHBZ#2530396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530396"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87648",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87648"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/513048243",
"url": "https://issues.chromium.org/issues/513048243"
}
],
"release_date": "2026-09-09T00:09:47.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "chromium-browser: angle: ANGLE: Arbitrary code execution in Google Chrome due to use-after-free"
},
{
"cve": "CVE-2026-87654",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input"
},
"discovery_date": "2026-09-09T01:04:02.338851+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2530305"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Chromium\u0027s ANGLE component. A remote attacker could exploit a buffer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to the execution of arbitrary code outside the browser\u0027s security sandbox, potentially compromising the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical for Red Hat because successful remote exploitation can escape process sandboxing to execute arbitrary code with the privileges of the running user. In Red Hat Enterprise Linux, the impacted rendering components are primarily utilized by graphical desktop applications and embedded WebKitGTK consumers, rather than default server deployments. Exploitation relies on convincing a user to open an untrusted webpage or document. Standard headless server installations that do not run graphical or web-rendering workloads face minimal exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87654"
},
{
"category": "external",
"summary": "RHBZ#2530305",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530305"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87654"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87654",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87654"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/536444790",
"url": "https://issues.chromium.org/issues/536444790"
}
],
"release_date": "2026-09-09T00:09:34.590000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE"
},
{
"cve": "CVE-2026-91720",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-09-15T22:32:28.682951+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2534673"
}
],
"notes": [
{
"category": "description",
"text": "An uninitialized resource flaw was found in the ANGLE component of the Chromium browser.\n\nUpstream bug(s):\n\nhttps://code.google.com/p/chromium/issues/detail?id=523470135",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: chromium-browser: Uninitialized resource in ANGLE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91720"
},
{
"category": "external",
"summary": "RHBZ#2534673",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534673"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91720"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91720",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91720"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/523470135",
"url": "https://issues.chromium.org/issues/523470135"
}
],
"release_date": "2026-09-15T20:41:29.530000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "chromium-browser: angle: chromium-browser: Uninitialized resource in ANGLE"
},
{
"cve": "CVE-2026-91738",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-09-15T21:21:16.173988+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2534404"
}
],
"notes": [
{
"category": "description",
"text": "An improper input validation flaw was found in the ANGLE component of the Chromium browser.\n\nUpstream bug(s):\n\nhttps://code.google.com/p/chromium/issues/detail?id=536450979",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "chromium-browser: angle: chromium-browser: Improper input validation in ANGLE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91738"
},
{
"category": "external",
"summary": "RHBZ#2534404",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534404"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91738",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91738"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91738",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91738"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/536450979",
"url": "https://issues.chromium.org/issues/536450979"
}
],
"release_date": "2026-09-15T20:41:35.801000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T16:35:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95589"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.AUS:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.src",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-debugsource-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-devel-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-debuginfo-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-0:2.54.1-1.el8_6.x86_64",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.i686",
"AppStream-8.6.0.Z.EUS.EXTENSION:webkit2gtk3-jsc-devel-debuginfo-0:2.54.1-1.el8_6.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "chromium-browser: angle: chromium-browser: Improper input validation in ANGLE"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.