CVE-2026-18487 is a user interface misrepresentation vulnerability (CWE-451) in the Epiphany browser. The flaw arises from improper parsing of URLs containing a colon in the userinfo section, such as 'https://trusted.com:[email protected]/'. This causes the browser's address bar and security indicators to display the safe domain (trusted.com) while actually loading content from the attacker-controlled domain (attacker.com). This discrepancy can be exploited to create convincing phishing pages that deceive users into trusting malicious sites. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and limited confidentiality and integrity impact. No known exploits are reported in the wild. Red Hat's advisory states that no currently supported Red Hat products are affected.

The vulnerability allows attackers to misrepresent the domain shown in the browser's address bar, potentially tricking users into trusting malicious websites. This can facilitate phishing attacks by hiding the true destination URL. The impact is limited to confidentiality and integrity with no reported impact on availability. There are no known active exploits targeting this vulnerability.

Red Hat has confirmed that this vulnerability does not affect any currently supported Red Hat products, so no action is required for Red Hat users. For users of Epiphany browser outside of Red Hat products, check with the browser vendor for patches or updates addressing this issue. Patch status is not yet confirmed—consult the vendor advisory for current remediation guidance.