SUSE CVE-2026-118598

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

SUSE CVE-2026-118599

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

domato

Domato 🍅 A DOM fuzzer Written and maintained by Ivan Fratric, [email protected] Copyright 2017 Google Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License ...

DEBIAN-CVE-2026-118599

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

CVE-2026-118599

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

DEBIAN-CVE-2026-118598

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

CVE-2026-118598

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

EUVD-2026-114699

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

CVE-2026-118599

A file overwrite vulnerability exists in Epiphany (version >= 47.0 ) when installing WebExtension packages from .xpi files. The root cause is that the decompress_xpi_thread() function in src/webextension/ephy-web-extension-manager.c uses libarchive with archive_read_support_format_all(), allow...

CVE-2026-118599 epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

EUVD-2026-114698

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

CVE-2026-118598 epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

CVE-2026-118598

A logic error in Epiphany (>= 45.0, through 51.x) allows a malicious website to bypass prompts for camera and microphone access. When a user approves a Clipboard or Website Data Access permission, the set_permission() function in src/ephy-window.c incorrectly falls into a branch that grants EP...

CVE-2026-118598 epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

CVE-2026-118598: GNOME Epiphany: A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user…

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

CVE-2026-118599: GNOME Epiphany: A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

PT-2026-134504

Name of the Vulnerable Software and Affected Versions Epiphany versions 47.0 and later Description A file overwrite issue occurs during the installation of WebExtension packages from .xpi files. In the decompress xpi thread function within src/webextension/ephy-web-extension-manager.c, the use of...

PT-2026-134503

Name of the Vulnerable Software and Affected Versions Epiphany versions 45.0 through 51.x Description A logic error in site permission handling occurs within the set permission function in src/ephy-window.c. When a user interacts with a WebKit permission dialog for CLIPBOARD or WEBSITE DATA ACCES...

CVE-2026-115683

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before...

EUVD-2026-113941

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before...