EUVD-2026-54296
GHSA-5w7g-jqwx-788x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
UI:R is mandatory as victim must click the link; C:L/I:L reflects credential-theft phishing risk without direct system compromise or availability impact.
Primary rating from Vendor (puiterwijk).
CVSS VectorVendor: puiterwijk
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:80@attacker.com/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.
AnalysisAI
Address bar spoofing in GNOME Epiphany 49.2 and earlier allows remote unauthenticated attackers to display a trusted domain in the browser UI while actually loading content from an attacker-controlled origin, enabling high-fidelity phishing attacks. Exploitation leverages RFC 3986 userinfo URL syntax - a crafted link such as https://trusted.com:80@attacker.com/ causes Epiphany to render trusted.com in the address bar and security menus while WebKit fetches and renders attacker.com. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the technique requires no tooling beyond a crafted URL.
Technical ContextAI
Epiphany (GNOME Web) is the default browser for the GNOME desktop environment, built on top of WebKitGTK. The root cause is incorrect parsing of the URL authority component: per RFC 3986, a URL of the form https://userinfo@host/ carries an optional userinfo segment before the @, allowing colons within it (e.g., user:password). In https://trusted.com:80@attacker.com/, the segment trusted.com:80 is the userinfo field and attacker.com is the actual network host. Epiphany incorrectly extracts and presents trusted.com as the displayed origin in its address bar and security UI while WebKit correctly resolves and loads attacker.com. CWE-451 (UI Misrepresentation of Critical Information) is the precise root-cause class: the browser's security-critical UI element - the address bar - misrepresents the true origin, directly undermining the trust model users rely on when making security decisions such as entering credentials.
RemediationAI
An upstream source-level fix has been committed to the GNOME Epiphany GitLab repository at https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af; however, a tagged patched release version has not been independently confirmed from the available data - users should monitor their Linux distribution's package repository for an updated Epiphany package and apply it as soon as available. The Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18487 should be consulted for RHEL-specific package availability. Until a patched package is distributed, the most effective compensating control is to use an alternative browser (Firefox, Chromium) for sensitive operations such as authentication portals, banking, or any site where credential entry is involved - this eliminates exposure without system-level trade-offs. Additionally, users should be trained to inspect raw URLs in email clients or messaging applications before clicking, paying attention to the presence of @ symbols in the authority component. Disabling Epiphany entirely in managed environments until a patched version is confirmed is a zero-risk remediation for organizations with low GNOME browser dependency.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today