{"id":"CVE-2026-118598","kind":"vulnerability","aliases":["CVE-2026-118598"],"related":[],"title":"Epiphany browser: clipboard approval silently grants camera and microphone access","description":"A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.\n\nIn src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:\n\n  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {\n\nBecause that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.\n\nA malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.\n\nRequirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.\n\nAffected: Epiphany >= 45.0 (bug present at least through 51.x).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976\nReporter acknowledgment: Fernando Munoz","summary":"Epiphany, the GNOME web browser, stores camera and microphone permission for a site when the user only approved a clipboard or website-data prompt. A malicious page that gets that approval can then use the camera and microphone without a further prompt.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["epiphany","gnome","linux-desktop","package"],"not_affected_if":["camera-microphone-not-granted","other-browser"],"how_to_check":"- Run `epiphany --version` and compare against the affected range (45.0 and later, through 51.x).\n- In Epiphany, open site permission settings for a site you visited and check whether camera or microphone shows as allowed without you approving it.","fix":"- Epiphany builds that include upstream commit 480c3648 (merge request 2249); the sources do not name a fixed release number.","status":"open","published_at":"2026-10-31T10:16:37+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","triaged_at":"2026-10-31T10:35:57+00:00","updated_at":"2026-10-31T10:35:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-31T10:35:57Z","model":"claude-haiku-5-5","output":{"fix":"- Epiphany builds that include upstream commit 480c3648 (merge request 2249); the sources do not name a fixed release number.","reach":"internet","title":"Epiphany browser: clipboard approval silently grants camera and microphone access","impact":"high","summary":"Epiphany, the GNOME web browser, stores camera and microphone permission for a site when the user only approved a clipboard or website-data prompt. A malicious page that gets that approval can then use the camera and microphone without a further prompt.","audience":"everyone","category":"package","nicknames":[],"who_cares":["epiphany","gnome","linux-desktop"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"A malicious site records camera and microphone without a permission prompt","analyst_note":"","how_to_check":"- Run `epiphany --version` and compare against the affected range (45.0 and later, through 51.x).\n- In Epiphany, open site permission settings for a site you visited and check whether camera or microphone shows as allowed without you approving it.","plain_action":"If you use the Epiphany browser, update it to a version with the GNOME fix, and check that camera and microphone are not allowed for sites you never approved.","needs_analyst":false,"not_affected_if":["other-browser","camera-microphone-not-granted"],"who_is_affected":"Only users of the Epiphany browser on Linux desktops from version 45.0 through at least 51.x. Exposure needs a visit to a malicious page and a click on Allow for a clipboard or website-data-access prompt. Users of other browsers are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000747,"input_tokens":4560,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118598':13A,16A '-2026':12A,15A '/gnome/epiphany/-/merge_requests/2249':248C '/gnome/epiphany/-/work_items/2976':254C '45.0':237C '480c3648':250C '51':243C 'access':10A,80C,112C,141C,169C,172C,187C,202C,233C 'acknowledg':256C 'affect':235C 'afterward':204C 'allow':225C 'allow/deny':100C 'alway':157C 'approv':4A,40B,54B,88C,194C 'audiovisu':213C 'branch':156C 'browser':2A,27B 'bug':238C 'camera':7A,29B,59B,77C 'camera/microphone':210C 'caus':76C 'choic':101C 'click':224C 'clipboard':3A,42B,108C,183C,196C,228C 'commit':249C 'confidenti':214C 'constant':154C 'control':125C 'cve':11A,14A 'data':46B,111C,186C,232C 'desktop':21B 'dialog':106C,188C 'differ':90C 'els':130C,136C 'else-if':129C 'enum':153C 'ephi':117C,138C,164C 'epiphani':1A,17B,23B,70C,236C 'error':68C 'expos':212C 'express':147C 'fell':126C 'fernando':257C 'fix':245C 'get':52B 'getusermedia':206C 'gitlab.gnome.org':247C,253C 'gitlab.gnome.org/gnome/epiphany/-/merge_requests/2249':246C 'gitlab.gnome.org/gnome/epiphany/-/work_items/2976':252C 'gnome':18B,25B 'grant':6A,83C 'handl':74C 'least':241C 'linux':20B 'linux-desktop':19B 'logic':67C 'malici':49B,190C,221C 'manag':123C 'microphon':9A,31B,61B,79C,144C,173C 'munoz':258C 'must':218C 'non':151C 'non-zero':150C 'obtain':193C 'origin':177C 'packag':22B 'page':50B,222C 'parti':200C 'permiss':32B,73C,91C,95C,105C,118C,122C,139C,165C 'permit':166C 'present':239C 'prompt':47B,65B,211C,234C 'ran':158C 'report':255C 'requir':215C 'saw':181C 'set':94C 'silent':5A 'site':35B,72C,176C,191C 'src/ephy-window.c':93C 'storag':201C 'store':28B,96C,115C,120C 'third':199C 'third-parti':198C 'type':107C,140C,161C 'upstream':251C 'use':57B,205C 'user':38B,86C,98C,179C 'victim':217C 'visit':219C 'web':26B 'webcam':142C,170C 'webkit':104C 'websit':45B,110C,185C,231C 'website-data':44B 'website-data-access':230C 'without':62B,207C 'written':134C 'wrote':163C 'x':244C 'zero':152C","nicknames":[],"mitigations":[],"who_affected":"Only users of the Epiphany browser on Linux desktops from version 45.0 through at least 51.x. Exposure needs a visit to a malicious page and a click on Allow for a clipboard or website-data-access prompt. Users of other browsers are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"If you use the Epiphany browser, update it to a version with the GNOME fix, and check that camera and microphone are not allowed for sites you never approved.","first_public_at":"2026-10-31T10:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"patrick@puiterwijk.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118598","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118598","severity":null,"published_at":"2026-10-31T10:16:37+00:00","modified_at":"2026-10-31T10:16:37+00:00","first_seen_at":"2026-10-31T10:34:56+00:00","fetched_at":"2026-10-31T10:34:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}