The vulnerability in GNOME Epiphany 49.2 arises from improper parsing of web addresses containing a colon in the userinfo part of the URL. When a user clicks a specially crafted link such as https://trusted.com:[email protected]/, the address bar and security indicators display 'trusted.com' as the domain, but the content loaded is from 'attacker.com'. This UI misrepresentation can be exploited to create convincing phishing pages that deceive users into trusting malicious sites. The issue is tracked as CVE-2026-18487 with a CVSS 3.1 base score of 5.4 (medium severity).

The vulnerability allows attackers to spoof the domain name shown in the browser's address bar, misleading users into believing they are visiting a legitimate site when they are actually on a malicious one. This can facilitate phishing attacks by exploiting user trust in the displayed URL. There is no indication of direct compromise of confidentiality or availability beyond the UI misrepresentation and potential for user deception.

According to the Red Hat advisory, this vulnerability does not affect any currently supported Red Hat products. No official patch or remediation level is provided in the advisory. Patch status is not yet confirmed—check the vendor advisory and GNOME Epiphany project for updates on fixes. Users should exercise caution when clicking links with unusual URL formats and verify URLs carefully. Vendors and users of Epiphany 49.2 should monitor for official patches or updates addressing this issue.