CVE-2026-118598mediumCWE-863

CVE-2026-118598: falha de média gravidade em GNOME Epiphany

epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Epiphany+ Monitorar epiphany-browser

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.5%
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as: } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) { Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality. Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt. Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
GNOME · Epiphany
CVEs relacionadas — GNOME Epiphany

No mesmo produto, das mais perigosas para as menos.

CVE-2026-18487MEDIUMEpiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()EPSS 0.3%CVE-2026-115683MEDIUMepiphany: TLS certificate warning bypass via race in tlsErrorPage message handlerEPSS 0.2%CVE-2026-118599MEDIUMepiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension installEPSS 0.2%