CVE-2026-118598
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In set_permission(), types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored, so control fell into an else-if branch that always set EPHY_PERMISSION_PERMIT for ACCESS_WEBCAM and ACCESS_MICROPHONE. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt.
Risk Assessment
A malicious site can gain access to the user's camera and microphone without their knowledge, compromising audiovisual confidentiality. This only requires the user to approve a clipboard or website data access prompt.
Recommendation
Update Epiphany to a version containing the fix (commit 480c3648). Exercise caution when approving browser permission prompts.
Other vulnerabilities in Epiphany
See all- CVE-2026-118599Medium
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. decompress_xpi_thread() used libarchive with archive_read_support_format_all(), allowing a TAR file named *.xpi to be extracted; a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a warning dialog, when the user installs or opens the crafted .xpi.
- CVE-2026-115683Medium
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. The 'tlsErrorPage' script message handler is registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin can call postMessage and approve a certificate exception without user interaction.
- CVE-2026-18487Medium
A flaw was found in Epiphany in how the browser reads web addresses, allowing attackers to fake the domain name shown in the address bar. Clicking a specially crafted link containing a colon (e.g., https://trusted.com:[email protected]/) displays the safe website (trusted.com) in the address bar but actually loads the attacker's website (attacker.com). This allows creating convincing phishing pages.
Original NVD description (English source)
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as: } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) { Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality. Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt. Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz
Vulnerability data from NVD (NIST) · CISA KEV · EPSS