Threats affecting pkg:github/gnome/epiphany

CVE-2026-118599 is a file overwrite vulnerability in GNOME Epiphany affecting versions 47.0 and later. The vulnerability arises when installing WebExtension packages from .xpi files, which can be crafted as TAR archives containing hard links. This allows an attacker to overwrite existing user-writable files without warning during installation or opening of the malicious .xpi. The issue requires user interaction and does not affect confidentiality or availability directly. A fix is available that restricts support to ZIP format only.

A logic error in GNOME Epiphany's site permission handling causes camera and microphone access to be granted when the user only approves clipboard or website data access permissions. This flaw allows a malicious site that obtains clipboard or storage access approval to use getUserMedia without additional prompts, exposing audiovisual confidentiality. The vulnerability affects Epiphany versions 45.0 through at least 51.x and requires user interaction to approve a clipboard or website-data-access prompt. A fix has been implemented in the upstream repository.

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.

CVE-2026-18487 is a medium severity vulnerability in the GNOME Epiphany browser where the address bar can be spoofed. An attacker can craft a URL containing a colon and userinfo to make the address bar display a trusted domain while actually loading a malicious site. This UI misrepresentation can facilitate phishing attacks by misleading users about the true website they are visiting. Red Hat has assessed that this vulnerability does not affect any currently supported Red Hat products.