---
id: "CVE-2026-118598"
kind: "vulnerability"
aliases: ["CVE-2026-118598"]
title: "Epiphany browser: clipboard approval silently grants camera and microphone access"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["epiphany", "gnome", "linux-desktop", "package"]
not_affected_if: ["camera-microphone-not-granted", "other-browser"]
published_at: "2026-10-31T10:16:37+00:00"
first_seen_at: "2026-10-31T10:34:56+00:00"
updated_at: "2026-10-31T10:35:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118598", "first_seen_at": "2026-10-31T10:34:56+00:00"}]
---

# Epiphany browser: clipboard approval silently grants camera and microphone access

Epiphany, the GNOME web browser, stores camera and microphone permission for a site when the user only approved a clipboard or website-data prompt. A malicious page that gets that approval can then use the camera and microphone without a further prompt.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `epiphany --version` and compare against the affected range (45.0 and later, through 51.x).
- In Epiphany, open site permission settings for a site you visited and check whether camera or microphone shows as allowed without you approving it.

## Fix

- Epiphany builds that include upstream commit 480c3648 (merge request 2249); the sources do not name a fixed release number.

## Timeline

- 2026-10-31T10:34:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118598

## From the sources

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.

In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:

  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {

Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.

A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.

Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.

Affected: Epiphany >= 45.0 (bug present at least through 51.x).
Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).
Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976
Reporter acknowledgment: Fernando Munoz

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_