Critical Security Update for webkit2gtk3: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:20922: Important: webkit2gtk3 security update. Affects webkit2gtk3 versions < 2.50.1-1.el9_7. Fixed in 2.50.1-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WebKitGTK is a port of the WebKit rendering engine designed for the GTK platform, enabling applications to render web content. It is widely used in various applications, including browsers and web-based tools. The package is essential for applications that require web content rendering capabilities. However, it has recently been identified as vulnerable to several security issues that could lead to crashes and unauthorized access to sensor information.
Vulnerability Detail
The vulnerabilities in webkit2gtk3 stem from the processing of maliciously crafted web content. These vulnerabilities can lead to unexpected crashes in the Safari browser and other processes, as well as unauthorized access to sensor information without user consent. The identified CVEs include CVE-2025-43272, CVE-2025-43342, CVE-2025-43343, CVE-2025-43356, and CVE-2025-43368, each representing a specific exploit that could compromise user security and application stability.
How To Fix
Minimum fixed version
2.50.1-1.el9_7
This is the first release that contains the fix.
sudo dnf update webkit2gtk3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable JavaScript in their web applications or avoid visiting untrusted websites until the package is updated. This can help mitigate the risk of exploitation while waiting for the official patch.
Conclusion
The vulnerabilities in webkit2gtk3 pose significant risks to applications that rely on this package for web content rendering. It is crucial to update to the latest patched version to ensure security and stability. Users are encouraged to monitor their applications for vulnerabilities and take necessary precautions until updates are applied.
See every vulnerability recorded for webkit2gtk3 →
FAQ
WebKitGTK is a web rendering engine for GTK applications, allowing them to display web content.
The vulnerabilities include crashes due to malicious web content and unauthorized access to sensor information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
Consider disabling JavaScript or avoiding untrusted websites as a temporary workaround.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for webkit2gtk3.
