openSUSE Ships Huge WebKit Update Closing More Than Two Hundred Browser Engine Flaws
openSUSE has issued announcement openSUSE-SU-2026:22076-1, a vendor-rated critical security update for the webkit2gtk3 package, and it rolls up more than two hundred CVEs in the WebKitGTK browser engine. The identifiers span four years of accumulated engine defects, running from CVE-2024-1283 and CVE-2024-43091 through the 2025 series including CVE-2025-6558, CVE-2025-26416 and CVE-2025-54627, and on into a very large 2026 block that includes CVE-2026-9877 to CVE-2026-9998, the CVE-2026-11xxx and CVE-2026-17xxx ranges, and the CVE-2026-64xxx and CVE-2026-79xxx ranges. The update is tracked internally against fifteen Bugzilla entries, bsc#1275791 and bsc#1277005 through bsc#1284619. Anyone running openSUSE with webkit2gtk3 installed is in scope, and that includes desktop builds where the library is pulled in as a dependency of mail clients, help viewers and embedded web views rather than installed deliberately.
The announcement is a package rebuild rather than a technical write-up, and the vendor has not published per-CVE exploitation detail in the message itself. What the published CVSS data does show is the shape of the risk. The large majority of the scored entries carry vectors of the form AV:N/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact, scoring 8.8 under CVSS v3.1 and 8.6 under v4.0, which is the signature of a memory-safety flaw in the rendering engine that fires when a user opens attacker-controlled web content. Two entries go further: CVE-2024-43091 and CVE-2025-26416 are both scored 9.8 with UI:N, meaning no user interaction is required at all. A smaller group inverts the model entirely, with CVE-2024-43768 at 7.8 and CVE-2025-48622 at 5.5 both requiring local access and low privileges, pointing at escalation and information disclosure for an attacker who already has a foothold. CVE-2025-32318 sits at 8.8 with PR:L, and CVE-2025-0444 is the mildest of the scored set at 6.3 with only low impact across the triad.
The strategic point is that webkit2gtk3 is not a browser the user chooses to launch. It is a shared rendering library that other desktop applications link against, so an organisation can be exposed through software nobody thinks of as a web browser, and a single unpatched host carries the whole accumulated backlog rather than one defect. The volume here also means the patch window has been open for a long time on some of these issues: the oldest identifiers date to 2024, and any system that has not taken webkit2gtk3 updates since then is carrying every one of them at once. On current exploitation status, the verified data covers only a subset. CVE-2024-1283 carries a 21.6 percent probability of exploitation in the next thirty days per FIRST EPSS, which is substantially above the rest of the measured group. The remaining CVEs with published EPSS figures sit far lower, between 0.2 and 0.7 percent, covering CVE-2024-43091, CVE-2024-43097, CVE-2024-43767, CVE-2024-43768, CVE-2024-7966, CVE-2024-8193, CVE-2024-8198, CVE-2024-8636, CVE-2024-9123, CVE-2025-0436 and CVE-2025-0444. No exploitation data is available for the other identifiers in this release, and none of them appear in the verified evidence set, so no claim either way can be made about them.
Attack Surface
Web Browser, Endpoint OS, Workspace
Tactics
Initial Access, Execution, Privilege Escalation
Techniques
- T1189 – Drive-by Compromise
- T1203 – Exploitation for Client Execution
- T1068 – Exploitation for Privilege Escalation
SuperPRO's Threat Countermeasures Procedures
- Install the openSUSE-SU-2026:22076-1 security update for webkit2gtk3 with 'zypper patch' or 'zypper in -t patch', and confirm the webkit2gtk3 package and its runtime libraries are at the post-update build on every affected host.
- Enumerate exposure first with 'zypper se –installed-only webkit2gtk3' and 'rpm -q –whatrequires webkit2gtk3', since the library is commonly pulled in as a dependency of desktop applications rather than installed directly, and those hosts will not appear on a browser inventory.
- Restart every process still linking the old WebKitGTK library after patching – use 'zypper ps -s' to list them – because the vulnerable code stays resident in memory until the embedding application is restarted or the host rebooted.
- Prioritise CVE-2024-1283 in the patch sequence; FIRST EPSS places it at a 21.6 percent probability of exploitation within 30 days, far above the 0.2 to 0.7 percent range of the other measured CVEs in this release.
- Treat multi-user and shared openSUSE systems as higher priority for the local-access entries CVE-2024-43768 (CVSS 7.8, AV:L/PR:L), CVE-2025-48622 (CVSS 5.5, AV:L/PR:L) and CVE-2025-32318 (CVSS 8.8, PR:L), and review which non-administrative accounts hold interactive shell access on them.
- Track the fifteen Bugzilla identifiers attached to this release – bsc#1275791, bsc#1277005 through bsc#1277018, bsc#1281116 and bsc#1284619 – in change management so the rollout can be evidenced as complete rather than partially applied.
- Alert on repeated crashes of WebKitGTK renderer and network processes using 'coredumpctl list' and systemd-coredump output on unpatched hosts, as repeated renderer aborts are the observable signal of memory-corruption exploitation attempts against this engine.
