The vulnerability in GNOME Epiphany involves improper parsing of web addresses containing a colon in the userinfo section (e.g., https://trusted.com:[email protected]/). This causes the browser's address bar and security indicators to display the trusted domain (trusted.com) while the content is loaded from the attacker-controlled domain (attacker.com). This discrepancy allows attackers to create convincing phishing pages by misrepresenting the actual domain to users. The issue is classified as a User Interface (UI) Misrepresentation of Critical Information and is tracked as CVE-2026-18487 with a CVSS 3.1 score of 5.4 (medium severity). Red Hat's analysis confirms no impact on their supported products.

The vulnerability allows attackers to mislead users by displaying a trusted domain in the address bar while loading content from a malicious domain. This can enable phishing attacks by exploiting user trust in the displayed URL. The confidentiality and integrity of user interactions may be compromised due to this UI spoofing. There is no indication of impact on availability. No known exploits in the wild have been reported.

Red Hat states that this vulnerability does not affect any currently supported Red Hat products, so no action is required for those users. For other users of GNOME Epiphany, check the vendor's advisory or official sources for patches or updates addressing this issue. Patch status is not confirmed in the provided data; users should monitor vendor advisories for remediation guidance.