Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-118598

epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

Affects Epiphany 45.0 and later, with the bug present at least through 51.x, when a site is approved for clipboard or website-data access. No vendor rating is given; CVSS is 6.5. A fix is merged, but no fixed release is listed.

Published
Last modified
published
Not listed in CISA KEV
Specific setups only
None on Exploit-DB, Metasploit or GitHub

Summary

Epiphany, the GNOME web browser, is affected, specifically its site permission handling for camera and microphone access. The flaw can cause a site to be granted camera and microphone access when the user only approved a clipboard or website-data access prompt, which could let a malicious site record audio and video without a separate camera or microphone request.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as: } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) { Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality. Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt. Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • epiphany

    From 45.0

References 4

access.redhat.com

bugzilla.redhat.com

gitlab.gnome.org

FAQ

Questions about CVE-2026-118598

What does this mean?

Approving a clipboard or website-data access prompt on a site can later let that site use getUserMedia to reach the camera and microphone without asking again. The prompt wrongly grants that camera and microphone access.Source: access.redhat.com

Am I affected, and how do I check?

Epiphany 45.0 and later, with the bug present at least through 51.x. It applies to CLIPBOARD and WEBSITE_DATA_ACCESS prompts, which are not stored by ephy_permission_is_stored_by_permissions_manager(). Compare the installed Epiphany version against these ranges.Source: access.redhat.com

What should I do about it?

The sources give no fixed release, only a merged fix (merge request 2249, commit 480c3648). Update to a release that includes that commit once it is available.Source: access.redhat.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

What if there's no patch?

Do not approve Clipboard or Website Data Access prompts on untrusted sites.Source: access.redhat.com