Epiphany

CVE-2026-118599 Oct 31, 09:29 MEDIUM This Month

Arbitrary file overwrite in GNOME Epiphany 47.0 and later allows an attacker-crafted WebExtension package to truncate and replace an existing user-writable file with attacker-controlled content and permission bits. The installer in src/webextension/ephy-web-extension-manager.c used libarchive with archive_read_support_format_all(), so a TAR archive renamed to *.xpi was accepted instead of only genuine ZIP files; a hard-link entry inside that TAR, combined with archive_write_disk options including ARCHIVE_EXTRACT_PERM, redirects the write onto an attacker-chosen existing file. The victim must deliberately install or open the malicious .xpi (UI:R, local delivery), severity is assessed at CVSS 5.5 with integrity-only impact, and no public exploit was identified at time of analysis; an upstream fix restricting the installer to ZIP format only has been merged but a tagged patched release is not confirmed in the available data.

CVE-2026-118598 Oct 31, 09:29 MEDIUM This Month

Epiphany (GNOME Web) 45.0 through 51.x writes a stored PERMIT for both the webcam and microphone permission of a site origin whenever a user answers an unrelated Clipboard or Website Data Access prompt, so the site can call getUserMedia afterwards without a dedicated camera/microphone dialog and capture audio and video. The root cause is a malformed else-if in set_permission() of src/ephy-window.c whose condition is a non-zero enum constant, making the branch unconditional for the two permission types that the permissions manager does not persist. Exploitation is conditional: the victim must visit the attacker's page and click Allow on a clipboard or third-party storage prompt (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5, CWE-863), and no public exploit code or CISA KEV entry was identified at time of analysis.

CVE-2023-26081 Feb 20, 03:15 HIGH POC PATCH This Week

In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2022-29536 Apr 20, 23:15 HIGH PATCH This Week

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

CVE-2021-45088 Dec 16, 03:15 MEDIUM POC PATCH This Month

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-45087 Dec 16, 03:15 MEDIUM POC PATCH This Month

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-45086 Dec 16, 03:15 MEDIUM POC PATCH This Month

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2021-45085 Dec 16, 03:15 MEDIUM POC PATCH This Month

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2019-6251 Jan 14, 08:29 HIGH POC PATCH This Week

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2018-12016 Jun 07, 14:29 HIGH POC This Week

libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-11396 May 23, 13:29 HIGH POC This Week

ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2017-1000025 Jul 17, 13:18 HIGH This Week

GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.