CVE-2026-118598Medium· 6.5▾ SunlitA logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice aft…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
Last analysed / modified upstream
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.
In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:
} else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {
Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.
A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.
Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.
Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz
epiphany >= 45.0 < *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Do not approve Clipboard or Website Data Access prompts on untrusted sites. Review and revoke camera and microphone site permissions in Epiphany (site permissions / privacy settings) for any origin where those prompts were accepted. Prefer browsing untrusted content with media devices disconnected or disabled at the OS level. Upgrade to a fixed Epiphany build containing MR !2249 / commit 480c3648 when available for your stream.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115683Medium· 6.8epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
CVE-2026-118599Medium· 5.5epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
CVE-2026-79902Medium· 5.5Gimp: stack vla size underflow denial of service in seattle
CVE-2026-80101Medium· 4.4Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
CVE-2026-82343Medium· 6.1Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
CVE-2026-82328Medium· 6.1Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count