Race Condition in Epiphany Browser Allows Bypass of TLS/SSL Warnings

CVE-2026-115683

What is CVE-2026-115683?

A race condition present in the Epiphany web browser exposes users to significant security risks by allowing malicious websites to circumvent TLS/SSL certificate warning pages. The issue arises when the browser's main-world script message handler for TLS errors, 'tlsErrorPage', is registered immediately before loading the error page. This timing creates a narrow window during which an untrusted origin can exploit the handler without any user interaction. By predicting and rapidly guessing the numeric WebKit page ID used for authorization checks, an attacker can approve a certificate exception. This flaw not only facilitates potential man-in-the-middle attacks but also allows for site spoofing. Affected users are advised to remain vigilant and update to newer versions once a patch is released.

References