Vulnerability-Lookup

CVE-2026-18487 (GCVE-0-2026-18487)

Vulnerability from cvelistv5 – Published: 2026-08-06 16:32 – Updated: 2026-08-07 15:39

Title

Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

Summary

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 15:37 UTC

CWE

CWE-451 - User Interface (UI) Misrepresentation of Critical Information

Assigner

fedora

References

4 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-18487	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2509570	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/epiphany/-/commit/…
https://gitlab.gnome.org/GNOME/epiphany/-/work_it…

Impacted products

1 product

Vendor	Product	Version
GNOME	Epiphany	Affected: 49.2 , < * (semver)

Date Public

2026-07-07 00:00

Credits

Red Hat would like to thank Fernando Munoz for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18487",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T15:37:47.946112Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T15:39:27.740Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/epiphany",
          "defaultStatus": "unaffected",
          "packageName": "epiphany",
          "product": "Epiphany",
          "vendor": "GNOME",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "49.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fernando Munoz for reporting this issue."
        }
      ],
      "datePublic": "2026-07-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-451",
              "description": "User Interface (UI) Misrepresentation of Critical Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T16:32:39.361Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18487"
        },
        {
          "name": "RHBZ#2509570",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509570"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-10T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-07T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-451: User Interface (UI) Misrepresentation of Critical Information"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-18487",
    "datePublished": "2026-08-06T16:32:39.361Z",
    "dateReserved": "2026-07-31T13:30:18.349Z",
    "dateUpdated": "2026-08-07T15:39:27.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-18487",
      "date": "2026-08-15",
      "epss": "0.00318",
      "percentile": "0.24598"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-18487\",\"sourceIdentifier\":\"patrick@puiterwijk.org\",\"published\":\"2026-08-06T22:16:50.250\",\"lastModified\":\"2026-08-07T16:17:22.807\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.\"}],\"affected\":[{\"source\":\"patrick@puiterwijk.org\",\"affectedData\":[{\"vendor\":\"GNOME\",\"product\":\"Epiphany\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://gitlab.gnome.org/GNOME/epiphany\",\"packageName\":\"epiphany\",\"versions\":[{\"version\":\"49.2\",\"lessThan\":\"*\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"patrick@puiterwijk.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-07T15:37:47.946112Z\",\"id\":\"CVE-2026-18487\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"patrick@puiterwijk.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-451\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-18487\",\"source\":\"patrick@puiterwijk.org\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2509570\",\"source\":\"patrick@puiterwijk.org\"},{\"url\":\"https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af\",\"source\":\"patrick@puiterwijk.org\"},{\"url\":\"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897\",\"source\":\"patrick@puiterwijk.org\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-08-06T14:20:57+00:00",
      "cve": "CVE-2026-18487",
      "id": "CVE-2026-18487",
      "initial_release_date": "2026-07-07T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18487.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18487\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-07T15:37:47.946112Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-07T15:39:08.575Z\"}}], \"cna\": {\"title\": \"Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Fernando Munoz for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"GNOME\", \"product\": \"Epiphany\", \"versions\": [{\"status\": \"affected\", \"version\": \"49.2\", \"lessThan\": \"*\", \"versionType\": \"semver\"}], \"packageName\": \"epiphany\", \"collectionURL\": \"https://gitlab.gnome.org/GNOME/epiphany\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-10T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-07-07T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-07-07T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-18487\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2509570\", \"name\": \"RHBZ#2509570\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af\"}, {\"url\": \"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-451\", \"description\": \"User Interface (UI) Misrepresentation of Critical Information\"}]}], \"providerMetadata\": {\"orgId\": \"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5\", \"shortName\": \"fedora\", \"dateUpdated\": \"2026-08-06T16:32:39.361Z\"}, \"x_redhatCweChain\": \"CWE-451: User Interface (UI) Misrepresentation of Critical Information\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-18487\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-07T15:39:27.740Z\", \"dateReserved\": \"2026-07-31T13:30:18.349Z\", \"assignerOrgId\": \"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5\", \"datePublished\": \"2026-08-06T16:32:39.361Z\", \"assignerShortName\": \"fedora\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-18487

Vulnerability from fkie_nvd - Published: 2026-08-06 22:16 - Updated: 2026-08-07 16:17

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	patrick@puiterwijk.org	https://access.redhat.com/security/cve/CVE-2026-18487
	patrick@puiterwijk.org	https://bugzilla.redhat.com/show_bug.cgi?id=2509570
	patrick@puiterwijk.org	https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af
	patrick@puiterwijk.org	https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/epiphany",
          "defaultStatus": "unaffected",
          "packageName": "epiphany",
          "product": "Epiphany",
          "vendor": "GNOME",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "49.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "patrick@puiterwijk.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site."
    }
  ],
  "id": "CVE-2026-18487",
  "lastModified": "2026-08-07T16:17:22.807",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-18487",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T15:37:47.946112Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T22:16:50.250",
  "references": [
    {
      "source": "patrick@puiterwijk.org",
      "url": "https://access.redhat.com/security/cve/CVE-2026-18487"
    },
    {
      "source": "patrick@puiterwijk.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509570"
    },
    {
      "source": "patrick@puiterwijk.org",
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af"
    },
    {
      "source": "patrick@puiterwijk.org",
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897"
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ],
      "source": "patrick@puiterwijk.org",
      "type": "Secondary"
    }
  ]
}

GHSA-5W7G-JQWX-788X

Vulnerability from github – Published: 2026-08-07 00:31 – Updated: 2026-08-07 00:31

Details

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:80@attacker.com/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-18487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-451"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-06T22:16:50Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.",
  "id": "GHSA-5w7g-jqwx-788x",
  "modified": "2026-08-07T00:31:15Z",
  "published": "2026-08-07T00:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18487"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-18487"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509570"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

ubuntu-cve-2026-18487

Vulnerability from osv_ubuntu

Published

2026-08-06 22:16

Modified

2026-08-13 00:02

Summary

Details

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:80@attacker.com/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Severity

5.4 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-18487	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-18487	REPORT
	https://access.redhat.com/security/cve/CVE-2026-18487	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2509570	REPORT
	https://gitlab.gnome.org/GNOME/epiphany/-/commit/…	REPORT
	https://gitlab.gnome.org/GNOME/epiphany/-/work_it…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "epiphany-browser",
            "binary_version": "3.18.11-0ubuntu1"
          },
          {
            "binary_name": "epiphany-browser-data",
            "binary_version": "3.18.11-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "epiphany-browser",
        "purl": "pkg:deb/ubuntu/epiphany-browser@3.18.11-0ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.16.3-1ubuntu1",
        "3.18.0-1ubuntu2",
        "3.18.1-1ubuntu1",
        "3.18.3-0ubuntu1",
        "3.18.5-0ubuntu1",
        "3.18.5-0ubuntu1.1",
        "3.18.10-0ubuntu1",
        "3.18.11-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "epiphany-browser",
            "binary_version": "3.28.6-0ubuntu1"
          },
          {
            "binary_name": "epiphany-browser-data",
            "binary_version": "3.28.6-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "epiphany-browser",
        "purl": "pkg:deb/ubuntu/epiphany-browser@3.28.6-0ubuntu1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.26.1-1ubuntu1",
        "3.26.1-1ubuntu2",
        "3.26.1-1ubuntu4",
        "3.26.5.1-1ubuntu1",
        "3.27.90-1ubuntu1",
        "3.28.0.1-1ubuntu1",
        "3.28.1-1ubuntu1",
        "3.28.5-0ubuntu1",
        "3.28.6-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "epiphany-browser",
            "binary_version": "3.36.4-0ubuntu2"
          },
          {
            "binary_name": "epiphany-browser-data",
            "binary_version": "3.36.4-0ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "epiphany-browser",
        "purl": "pkg:deb/ubuntu/epiphany-browser@3.36.4-0ubuntu2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.34.1-1",
        "3.34.1-1build1",
        "3.36.0-1",
        "3.36.1-1",
        "3.36.2-0ubuntu1",
        "3.36.3-0ubuntu1",
        "3.36.4-0ubuntu1",
        "3.36.4-0ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "epiphany-browser",
            "binary_version": "42.4-0ubuntu1"
          },
          {
            "binary_name": "epiphany-browser-data",
            "binary_version": "42.4-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "epiphany-browser",
        "purl": "pkg:deb/ubuntu/epiphany-browser@42.4-0ubuntu1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "41.0-1",
        "41.0-2",
        "41.2-1",
        "41.3-1",
        "42~beta-1",
        "42.0-1",
        "42.1-1",
        "42.1-1ubuntu1",
        "42.4-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "epiphany-browser",
            "binary_version": "46.5-0ubuntu1"
          },
          {
            "binary_name": "epiphany-browser-data",
            "binary_version": "46.5-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "epiphany-browser",
        "purl": "pkg:deb/ubuntu/epiphany-browser@46.5-0ubuntu1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "45.0-1",
        "45.1-1",
        "46~alpha-1",
        "46~beta-1",
        "46.0-1",
        "46.0-2build1",
        "46.5-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "epiphany-browser",
            "binary_version": "49.2-3ubuntu1"
          },
          {
            "binary_name": "epiphany-browser-data",
            "binary_version": "49.2-3ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "epiphany-browser",
        "purl": "pkg:deb/ubuntu/epiphany-browser@49.2-3ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "48.5-3",
        "49.1-1",
        "49.2-1",
        "49.2-2",
        "49.2-3",
        "49.2-3ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.",
  "id": "UBUNTU-CVE-2026-18487",
  "modified": "2026-08-13T00:02:19Z",
  "published": "2026-08-06T22:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-18487"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18487"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-18487"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509570"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af"
    },
    {
      "type": "REPORT",
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-18487"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-18487 (GCVE-0-2026-18487)

FKIE_CVE-2026-18487

GHSA-5W7G-JQWX-788X

ubuntu-cve-2026-18487

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature