CVE-2026-118598
Received Received - Intake

Permission Bypass in Epiphany Browser

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Fedora Project

Description
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as: } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) { Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality. Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt. Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-118598
EUVD
EUVD-2026-114698

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GNOME Epiphany 45.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a logic error in Epiphany (GNOME Web Browser) where granting one permission like clipboard or website data access unintentionally also grants camera and microphone access. The browser incorrectly stores these permissions, causing a flawed conditional check to always permit webcam and microphone access without a separate prompt.

Detection Guidance

Check Epiphany browser permissions for unexpected camera or microphone access. Review browser settings for stored permissions under 'Site Settings' or similar. Look for malicious sites with granted clipboard or website data access that may have unintended media permissions.

Impact Analysis

A malicious website could trick you into clicking Allow on a harmless-looking permission prompt. Once granted, the site can silently access your camera and microphone using getUserMedia, compromising your audiovisual privacy without further interaction.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized access to audiovisual data through the camera and microphone without explicit user consent. Malicious sites could capture sensitive information, breaching confidentiality requirements.

Mitigation Strategies

Do not approve clipboard or website data access prompts on untrusted sites. Review and revoke camera/microphone permissions in Epiphany. Disable media devices at the OS level when browsing untrusted content. Upgrade Epiphany to a fixed version (commit 480c3648 or later).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart