Live › vulnerability › CVE-2026-118598
Epiphany, the GNOME web browser, stores camera and microphone permission for a site when the user only approved a clipboard or website-data prompt. A malicious page that gets that approval can then use the camera and microphone without a further prompt.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 10:34 UTC. All times on this page are UTC.
Only users of the Epiphany browser on Linux desktops from version 45.0 through at least 51.x. Exposure needs a visit to a malicious page and a click on Allow for a clipboard or website-data-access prompt. Users of other browsers are not affected.
No product ranges from the sources yet.
epiphany --version and compare against the affected range (45.0 and later, through 51.x).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.
In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:
} else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {
Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.
A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.
Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.
Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz
This page as .md · .json · in your agent: get_signal("CVE-2026-118598")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.