diff --git a/yelp-3.28.1-fix-CVE-2026-13601.patch b/yelp-3.28.1-fix-CVE-2026-13601.patch
new file mode 100644
index 0000000..afcbe96
--- /dev/null
+++ b/yelp-3.28.1-fix-CVE-2026-13601.patch
@@ -0,0 +1,28 @@
+From 4d2857ae2cfc1393fb617f6fa7be1c66de84d520 Mon Sep 17 00:00:00 2001
+From: Shaun McCance <shaunm@redhat.com>
+Date: Wed, 6 May 2026 12:12:57 -0400
+Subject: [PATCH] Don't allow loading external resources from web pages
+
+This is an attack vector for sending data places.
+---
+ libyelp/web-extension/yelp-web-extension.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/libyelp/web-extension/yelp-web-extension.c b/libyelp/web-extension/yelp-web-extension.c
+index c835021d..731e006b 100644
+--- a/libyelp/web-extension/yelp-web-extension.c
++++ b/libyelp/web-extension/yelp-web-extension.c
+@@ -74,6 +74,10 @@ web_page_send_request (WebKitWebPage     *web_page,
+     const gchar *resource_uri = webkit_uri_request_get_uri (request);
+     gchar *yelp_uri, *file_path;
+ 
++    /* Don't allow loading external resources at all, for security */
++    if (g_str_has_prefix (resource_uri, "http://") || g_str_has_prefix (resource_uri, "https://"))
++        return TRUE;
++
+     if (!current_uri)
+         return FALSE;
+ 
+-- 
+2.55.0
+
diff --git a/yelp.spec b/yelp.spec
index 169bfb3..788bd98 100644
--- a/yelp.spec
+++ b/yelp.spec
@@ -3,7 +3,7 @@
 Name:          yelp
 Epoch:         2
 Version:       3.28.1
-Release:       3%{?dist}.1
+Release:       3%{?dist}.2
 Summary:       Help browser for the GNOME desktop
 
 Group:         Applications/System
@@ -37,6 +37,9 @@ Patch19:       0017-Remove-the-unused-encoding-and-language-code-from-Ye.patch
 Patch20:       yelp-quit.patch
 # https://issues.redhat.com/browse/RHEL-85922
 Patch21:       yelp-CVE-2025-3155.patch
+# https://redhat.atlassian.net/browse/RHEL-190226
+# https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
+Patch22:       yelp-3.28.1-fix-CVE-2026-13601.patch
 
 BuildRequires: pkgconfig(gtk+-3.0)
 BuildRequires: pkgconfig(liblzma)
@@ -126,6 +129,9 @@ desktop-file-validate $RPM_BUILD_ROOT%{_datadir}/applications/yelp.desktop
 
 
 %changelog
+* Tue Jul 07 2026 David King <dking@redhat.com> - 2:3.28.1-3.2
+- Fix CVE-2026-13601 (RHEL-190226)
+
 * Wed Apr 23 2025 David King <dking@redhat.com> - 2:3.28.1-3.1
 - Fix CVE-2025-3155 (RHEL-85922)