GNOME Epiphany CVE-2026-118598

The victim must be running Epiphany in the affected range (>= 45.0 through 51.x) and must both visit the attacker's page and click Allow on a Clipboard or Website Data Access permission dialog - those are the only prompt types that route into the buggy else-if branch. No browser authentication is required (PR:N), but the mandatory Allow click (UI:R) and the fact that only those two permission dialogs trigger the bug meaningfully limit exploitation: a user who denies or ignores the prompt is not affected, and the site must present a convincing pretext for clipboard or third-party storage access. The only complete fix per the vendor is updating to the patched build (merge request 2249 / commit 480c3648); no configuration mitigation is described in the sources.

This is a genuine but conditional authorization-bypass (CWE-863) in GNOME's Epiphany/Web browser, best characterized as medium real-world risk rather than an emergency. The CVSS 3.1 base of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) is internally consistent with the described mechanism: exploitation is network-reachable via a malicious web page, needs no authentication to the browser, but does require user interaction - the victim must click Allow on a clipboard or website-data-access permission dialog. The impact is confidentiality-only (C:H, I:N, A:N), which matches silent camera/microphone capture with no integrity or availability effect. No EPSS score was supplied, the CVE is not on CISA KEV, and no exploit or PoC reference appears in the input (the GitLab merge request and commit are the fix, not an exploit), so exploitation status is: no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', not act_now/emergency, and the signals agree - a real authorization flaw gated behind a deceptive-but-required user click, not mass-exploitable drive-by code execution. The main caveat is that the fix commit (480c3648) publicly discloses the exact one-line logic error, lowering the bar to reproduce, so defenders should patch within the vendor's expected cadence rather than treat it as low priority indefinitely.

A victim using Epiphany visits an attacker-controlled page that presents a plausible reason to grant clipboard or third-party (website-data-access) permission and clicks Allow. Because set_permission() wrongly records EPHY_PERMISSION_PERMIT for both webcam and microphone for that origin, the site can then call getUserMedia() and capture audio/video with no further prompt. No public exploit code is referenced; the attack requires the social-engineering step of obtaining that single Allow click (UI:R).