CVE-2026-115683
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. The 'tlsErrorPage' script message handler is registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin can call postMessage and approve a certificate exception without user interaction.
Risk Assessment
An attacker can disable TLS certificate error warnings for a chosen host until the browser is restarted, enabling man-in-the-middle or site spoofing. This only requires the victim to visit a malicious site.
Recommendation
Monitor for the Epiphany fix (registering handlers on LOAD_COMMITTED) and apply it as soon as it is released. Until then, consider limiting reliance on Epiphany in high-security environments.
Other vulnerabilities in Epiphany
See all- CVE-2026-118599Medium
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. decompress_xpi_thread() used libarchive with archive_read_support_format_all(), allowing a TAR file named *.xpi to be extracted; a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a warning dialog, when the user installs or opens the crafted .xpi.
- CVE-2026-118598Medium
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In set_permission(), types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored, so control fell into an else-if branch that always set EPHY_PERMISSION_PERMIT for ACCESS_WEBCAM and ACCESS_MICROPHONE. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt.
- CVE-2026-18487Medium
A flaw was found in Epiphany in how the browser reads web addresses, allowing attackers to fake the domain name shown in the address bar. Clicking a specially crafted link containing a colon (e.g., https://trusted.com:[email protected]/) displays the safe website (trusted.com) in the address bar but actually loads the attacker's website (attacker.com). This allows creating convincing phishing pages.
Original NVD description (English source)
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS