Vulnerability-Lookup

OPENSUSE-SU-2026:12379-1

Vulnerability from csaf_opensuse - Published: 2026-11-01 00:00 - Updated: 2026-11-03 21:53

Summary

epiphany-51.2-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: epiphany-51.2-1.1 on GA media

Description of the patch: These are all security issues fixed in the epiphany-51.2-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-12379

CVE-2026-115683

Affected products

Recommended 16 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-118598

Affected products

Recommended 16 products, the same list as for CVE-2026-115683

Threats

Impact moderate

CVE-2026-118599

Affected products

Recommended 16 products, the same list as for CVE-2026-115683

Threats

Impact moderate

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-115683/	self
https://www.suse.com/security/cve/CVE-2026-118598/	self
https://www.suse.com/security/cve/CVE-2026-118599/	self
https://www.suse.com/security/cve/CVE-2026-115683	external
https://bugzilla.suse.com/1288016	external
https://www.suse.com/security/cve/CVE-2026-118598	external
https://bugzilla.suse.com/1288945	external
https://www.suse.com/security/cve/CVE-2026-118599	external
https://bugzilla.suse.com/1288946	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "epiphany-51.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the epiphany-51.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12379",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12379-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-115683 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-115683/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-118598 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-118598/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-118599 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-118599/"
      }
    ],
    "title": "epiphany-51.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-11-03T21:53:31Z",
      "generator": {
        "date": "2026-11-01T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12379-1",
      "initial_release_date": "2026-11-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-11-01T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-03T21:53:31Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "epiphany-0:51.2-1.1.aarch64",
                "product": {
                  "name": "epiphany-0:51.2-1.1.aarch64",
                  "product_id": "epiphany-0:51.2-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany@51.2-1.1?arch=aarch64\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-branding-upstream-0:51.2-1.1.aarch64",
                "product": {
                  "name": "epiphany-branding-upstream-0:51.2-1.1.aarch64",
                  "product_id": "epiphany-branding-upstream-0:51.2-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-branding-upstream@51.2-1.1?arch=aarch64\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-lang-0:51.2-1.1.aarch64",
                "product": {
                  "name": "epiphany-lang-0:51.2-1.1.aarch64",
                  "product_id": "epiphany-lang-0:51.2-1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-lang@51.2-1.1?arch=aarch64\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
                "product": {
                  "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
                  "product_id": "gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnome-shell-search-provider-epiphany@51.2-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "epiphany-0:51.2-1.1.ppc64le",
                "product": {
                  "name": "epiphany-0:51.2-1.1.ppc64le",
                  "product_id": "epiphany-0:51.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany@51.2-1.1?arch=ppc64le\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-branding-upstream-0:51.2-1.1.ppc64le",
                "product": {
                  "name": "epiphany-branding-upstream-0:51.2-1.1.ppc64le",
                  "product_id": "epiphany-branding-upstream-0:51.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-branding-upstream@51.2-1.1?arch=ppc64le\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-lang-0:51.2-1.1.ppc64le",
                "product": {
                  "name": "epiphany-lang-0:51.2-1.1.ppc64le",
                  "product_id": "epiphany-lang-0:51.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-lang@51.2-1.1?arch=ppc64le\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
                "product": {
                  "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
                  "product_id": "gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnome-shell-search-provider-epiphany@51.2-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "epiphany-0:51.2-1.1.s390x",
                "product": {
                  "name": "epiphany-0:51.2-1.1.s390x",
                  "product_id": "epiphany-0:51.2-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany@51.2-1.1?arch=s390x\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-branding-upstream-0:51.2-1.1.s390x",
                "product": {
                  "name": "epiphany-branding-upstream-0:51.2-1.1.s390x",
                  "product_id": "epiphany-branding-upstream-0:51.2-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-branding-upstream@51.2-1.1?arch=s390x\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-lang-0:51.2-1.1.s390x",
                "product": {
                  "name": "epiphany-lang-0:51.2-1.1.s390x",
                  "product_id": "epiphany-lang-0:51.2-1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-lang@51.2-1.1?arch=s390x\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
                "product": {
                  "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
                  "product_id": "gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnome-shell-search-provider-epiphany@51.2-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "epiphany-0:51.2-1.1.x86_64",
                "product": {
                  "name": "epiphany-0:51.2-1.1.x86_64",
                  "product_id": "epiphany-0:51.2-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany@51.2-1.1?arch=x86_64\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-branding-upstream-0:51.2-1.1.x86_64",
                "product": {
                  "name": "epiphany-branding-upstream-0:51.2-1.1.x86_64",
                  "product_id": "epiphany-branding-upstream-0:51.2-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-branding-upstream@51.2-1.1?arch=x86_64\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "epiphany-lang-0:51.2-1.1.x86_64",
                "product": {
                  "name": "epiphany-lang-0:51.2-1.1.x86_64",
                  "product_id": "epiphany-lang-0:51.2-1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnome:epiphany:51.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/epiphany-lang@51.2-1.1?arch=x86_64\u0026upstream=epiphany-0:51.2-1.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64",
                "product": {
                  "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64",
                  "product_id": "gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnome-shell-search-provider-epiphany@51.2-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-0:51.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64"
        },
        "product_reference": "epiphany-0:51.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-0:51.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le"
        },
        "product_reference": "epiphany-0:51.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-0:51.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x"
        },
        "product_reference": "epiphany-0:51.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-0:51.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64"
        },
        "product_reference": "epiphany-0:51.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-branding-upstream-0:51.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64"
        },
        "product_reference": "epiphany-branding-upstream-0:51.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-branding-upstream-0:51.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le"
        },
        "product_reference": "epiphany-branding-upstream-0:51.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-branding-upstream-0:51.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x"
        },
        "product_reference": "epiphany-branding-upstream-0:51.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-branding-upstream-0:51.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64"
        },
        "product_reference": "epiphany-branding-upstream-0:51.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-lang-0:51.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64"
        },
        "product_reference": "epiphany-lang-0:51.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-lang-0:51.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le"
        },
        "product_reference": "epiphany-lang-0:51.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-lang-0:51.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x"
        },
        "product_reference": "epiphany-lang-0:51.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "epiphany-lang-0:51.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64"
        },
        "product_reference": "epiphany-lang-0:51.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64"
        },
        "product_reference": "gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le"
        },
        "product_reference": "gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x"
        },
        "product_reference": "gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64"
        },
        "product_reference": "gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-115683",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-115683"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.\n\nEpiphany registers the main-world script message handler \"tlsErrorPage\" so its internal TLS error page can implement \"Accept Risk and Proceed\". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click.\n\nIf a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host.\n\nUpstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978\nProof of concept: https://beford.net/poc/ssl_poc.html\nFix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-115683",
          "url": "https://www.suse.com/security/cve/CVE-2026-115683"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1288016 for CVE-2026-115683",
          "url": "https://bugzilla.suse.com/1288016"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-115683"
    },
    {
      "cve": "CVE-2026-118598",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-118598"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A logic error in Epiphany\u0027s site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.\n\nIn src/ephy-window.c, set_permission() stores the user\u0027s Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:\n\n  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {\n\nBecause that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.\n\nA malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.\n\nRequirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.\n\nAffected: Epiphany \u003e= 45.0 (bug present at least through 51.x).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976\nReporter acknowledgment: Fernando Munoz",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-118598",
          "url": "https://www.suse.com/security/cve/CVE-2026-118598"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1288945 for CVE-2026-118598",
          "url": "https://bugzilla.suse.com/1288945"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-118598"
    },
    {
      "cve": "CVE-2026-118599",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-118599"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\n\nIn src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany\u0027s archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.\n\nThis is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).\n\nRequirements: the victim must install or open a malicious WebExtension (.xpi).\n\nAffected: Epiphany \u003e= 47.0 (WebExtension XPI install path).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 - only enable ZIP format support).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988\nReporter acknowledgment: Fernando Munoz",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
          "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-118599",
          "url": "https://www.suse.com/security/cve/CVE-2026-118599"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1288946 for CVE-2026-118599",
          "url": "https://bugzilla.suse.com/1288946"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-branding-upstream-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:epiphany-lang-0:51.2-1.1.x86_64",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.aarch64",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.ppc64le",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.s390x",
            "openSUSE Tumbleweed:gnome-shell-search-provider-epiphany-0:51.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-118599"
    }
  ]
}

CVE-2026-115683 (GCVE-0-2026-115683)

Vulnerability from cvelistv5 – Published: 2026-10-30 13:33 – Updated: 2026-11-02 11:33

Title

epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler

Summary

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 14:07 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

fedora CNA under the redhat root

CNA scorecard C 69/100 over 42 records in the last 180 days details

References

5 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-115683	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2560012	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/epiphany/-/work_it…
https://gitlab.gnome.org/GNOME/epiphany/-/merge_r…
https://beford.net/poc/ssl_poc.html

Impacted products

1 product

Vendor	Product	Version
GNOME	Epiphany	Affected: 0 , < 51.1 (semver)

Date Public

2026-10-21 00:00

Credits

Red Hat would like to thank Fernando Munoz for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115683",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T14:07:43.922960Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T14:08:15.038Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/epiphany",
          "defaultStatus": "affected",
          "packageName": "epiphany",
          "product": "Epiphany",
          "vendor": "GNOME",
          "versions": [
            {
              "lessThan": "51.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fernando Munoz for reporting this issue."
        }
      ],
      "datePublic": "2026-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.\n\nEpiphany registers the main-world script message handler \"tlsErrorPage\" so its internal TLS error page can implement \"Accept Risk and Proceed\". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click.\n\nIf a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host.\n\nUpstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978\nProof of concept: https://beford.net/poc/ssl_poc.html\nFix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T11:33:33.900Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-115683"
        },
        {
          "name": "RHBZ#2560012",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560012"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245"
        },
        {
          "url": "https://beford.net/poc/ssl_poc.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-21T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-21T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler",
      "workarounds": [
        {
          "lang": "en",
          "value": "Until a fixed Epiphany build is installed, avoid following links from untrusted sites to HTTPS destinations, and do not rely on Epiphany for sensitive sites when browsing untrusted content. Restrict network access for untrusted browsing where practical (https://cmetaxonomy.org/entries/CME-203.html). Restarting the browser clears any attacker-installed certificate exceptions for the session."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-115683",
    "datePublished": "2026-10-30T13:33:02.733Z",
    "dateReserved": "2026-10-23T08:58:10.076Z",
    "dateUpdated": "2026-11-02T11:33:33.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118598 (GCVE-0-2026-118598)

Vulnerability from cvelistv5 – Published: 2026-10-31 09:29 – Updated: 2026-10-31 09:29

Title

epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

Summary

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as: } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) { Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality. Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt. Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

fedora CNA under the redhat root

CNA scorecard C 69/100 over 42 records in the last 180 days details

References

4 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-118598	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2562956	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/epiphany/-/work_it…
https://gitlab.gnome.org/GNOME/epiphany/-/merge_r…

Impacted products

1 product

Vendor	Product	Version
GNOME	Epiphany	Affected: 45.0 , < * (semver)

Date Public

2026-10-24 00:00

Credits

Red Hat would like to thank Fernando Munoz for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/epiphany",
          "defaultStatus": "unaffected",
          "packageName": "epiphany",
          "product": "Epiphany",
          "vendor": "GNOME",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "45.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fernando Munoz for reporting this issue."
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A logic error in Epiphany\u0027s site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.\n\nIn src/ephy-window.c, set_permission() stores the user\u0027s Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:\n\n  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {\n\nBecause that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.\n\nA malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.\n\nRequirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.\n\nAffected: Epiphany \u003e= 45.0 (bug present at least through 51.x).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976\nReporter acknowledgment: Fernando Munoz"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T09:29:34.128Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-118598"
        },
        {
          "name": "RHBZ#2562956",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562956"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-24T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not approve Clipboard or Website Data Access prompts on untrusted sites. Review and revoke camera and microphone site permissions in Epiphany (site permissions / privacy settings) for any origin where those prompts were accepted. Prefer browsing untrusted content with media devices disconnected or disabled at the OS level. Upgrade to a fixed Epiphany build containing MR !2249 / commit 480c3648 when available for your stream."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-863: Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-118598",
    "datePublished": "2026-10-31T09:29:34.128Z",
    "dateReserved": "2026-10-28T16:47:07.290Z",
    "dateUpdated": "2026-10-31T09:29:34.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118599 (GCVE-0-2026-118599)

Vulnerability from cvelistv5 – Published: 2026-10-31 09:29 – Updated: 2026-10-31 09:29

Title

epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

Summary

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

fedora CNA under the redhat root

CNA scorecard C 69/100 over 42 records in the last 180 days details

References

4 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-118599	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2562969	issue-trackingx_refsource_REDHAT
https://gitlab.gnome.org/GNOME/epiphany/-/work_it…
https://gitlab.gnome.org/GNOME/epiphany/-/merge_r…

Impacted products

1 product

Vendor	Product	Version
GNOME	Epiphany	Affected: 47.0 , < * (semver)

Date Public

2026-10-24 00:00

Credits

Red Hat would like to thank Fernando Munoz for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/epiphany",
          "defaultStatus": "unaffected",
          "packageName": "epiphany",
          "product": "Epiphany",
          "vendor": "GNOME",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "47.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fernando Munoz for reporting this issue."
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\n\nIn src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany\u0027s archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.\n\nThis is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).\n\nRequirements: the victim must install or open a malicious WebExtension (.xpi).\n\nAffected: Epiphany \u003e= 47.0 (WebExtension XPI install path).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 \u2014 only enable ZIP format support).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988\nReporter acknowledgment: Fernando Munoz"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T09:29:37.264Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-118599"
        },
        {
          "name": "RHBZ#2562969",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562969"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-23T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not install WebExtensions (.xpi) from untrusted sources. Prefer keeping WebExtensions disabled when unused (Epiphany can refuse install when the feature is disabled in recent fixes). After any untrusted .xpi install attempt, inspect unexpectedly modified user files (for example shell startup files, autostart desktop entries, or SSH authorized_keys). Upgrade to a fixed Epiphany build containing MR !2248 / commit 0cc9ab55 when available for your stream."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-118599",
    "datePublished": "2026-10-31T09:29:37.264Z",
    "dateReserved": "2026-10-28T16:47:14.805Z",
    "dateUpdated": "2026-10-31T09:29:37.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:12379-1

CVE-2026-115683 (GCVE-0-2026-115683)

CVE-2026-118598 (GCVE-0-2026-118598)

CVE-2026-118599 (GCVE-0-2026-118599)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour