Logic Error in Epiphany Affects Site Permission Handling for Camera and Microphone Access
CVE-2026-118598
6.5MEDIUM
What is CVE-2026-118598?
A logic error in Epiphany's site permission handling allows malicious pages to gain unauthorized access to a user's camera and microphone. This issue arises from a failure to properly store permission choices for clipboard and website data access. Consequently, when a user grants permission for one of these prompts, the browser erroneously permits access to audiovisual capabilities without a subsequent prompt. Users are at risk when visiting malicious sites that exploit this flaw, as their privacy can be severely compromised.
Affected Version(s)
Epiphany 45.0
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Fernando Munoz for reporting this issue.