epiphany vulnerabilities
CVEs whose affected-version data names the epiphany package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-118599Medium· 5.5epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (a…
CVE-2026-118598Medium· 6.5epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice aft…
CVE-2026-115683Medium· 6.8PoCepiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk an…