{"api_version":"1","generated_at":"2026-11-05T06:43:55+00:00","cve":"CVE-2026-118598","urls":{"html":"https://cve.report/CVE-2026-118598","api":"https://cve.report/api/cve/CVE-2026-118598.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-118598","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118598"},"summary":{"title":"epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access","description":"A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.\n\nIn src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:\n\n  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {\n\nBecause that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.\n\nA malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.\n\nRequirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.\n\nAffected: Epiphany >= 45.0 (bug present at least through 51.x).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976\nReporter acknowledgment: Fernando Munoz","state":"PUBLISHED","assigner":"fedora","published_at":"2026-10-31 10:16:37","updated_at":"2026-11-02 19:35:33"},"problem_types":["CWE-863","CWE-863 Incorrect Authorization"],"metrics":[{"version":"3.1","source":"patrick@puiterwijk.org","type":"Secondary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118598","name":"https://access.redhat.com/security/cve/CVE-2026-118598","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249","name":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562956","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2562956","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976","name":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976","refsource":"patrick@puiterwijk.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118598","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118598","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"GNOME","product":"Epiphany","version":"affected 45.0 * semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-10-24T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-10-24T00:00:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Do not approve Clipboard or Website Data Access prompts on untrusted sites. Review and revoke camera and microphone site permissions in Epiphany (site permissions / privacy settings) for any origin where those prompts were accepted. Prefer browsing untrusted content with media devices disconnected or disabled at the OS level. Upgrade to a fixed Epiphany build containing MR !2249 / commit 480c3648 when available for your stream.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Red Hat would like to thank Fernando Munoz for reporting this issue.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"118598","cve":"CVE-2026-118598","epss":"0.004690000","percentile":"0.405710000","score_date":"2026-11-02","updated_at":"2026-11-03 00:03:07"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://gitlab.gnome.org/GNOME/epiphany","defaultStatus":"unaffected","packageName":"epiphany","product":"Epiphany","vendor":"GNOME","versions":[{"lessThan":"*","status":"affected","version":"45.0","versionType":"semver"}]}],"credits":[{"lang":"en","value":"Red Hat would like to thank Fernando Munoz for reporting this issue."}],"datePublic":"2026-10-24T00:00:00.000Z","descriptions":[{"lang":"en","value":"A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.\n\nIn src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:\n\n  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {\n\nBecause that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.\n\nA malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.\n\nRequirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.\n\nAffected: Epiphany >= 45.0 (bug present at least through 51.x).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976\nReporter acknowledgment: Fernando Munoz"}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-31T09:29:34.128Z","orgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","shortName":"fedora"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-118598"},{"name":"RHBZ#2562956","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562956"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976"},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249"}],"timeline":[{"lang":"en","time":"2026-10-24T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-24T00:00:00.000Z","value":"Made public."}],"title":"epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access","workarounds":[{"lang":"en","value":"Do not approve Clipboard or Website Data Access prompts on untrusted sites. Review and revoke camera and microphone site permissions in Epiphany (site permissions / privacy settings) for any origin where those prompts were accepted. Prefer browsing untrusted content with media devices disconnected or disabled at the OS level. Upgrade to a fixed Epiphany build containing MR !2249 / commit 480c3648 when available for your stream."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-863: Incorrect Authorization"}},"cveMetadata":{"assignerOrgId":"92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5","assignerShortName":"fedora","cveId":"CVE-2026-118598","datePublished":"2026-10-31T09:29:34.128Z","dateReserved":"2026-10-28T16:47:07.290Z","dateUpdated":"2026-10-31T09:29:34.128Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-31 10:16:37","lastModifiedDate":"2026-11-02 19:35:33","problem_types":["CWE-863","CWE-863 Incorrect Authorization"],"metrics":{"cvssMetricV31":[{"source":"patrick@puiterwijk.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"118598","Ordinal":"1","Title":"epiphany: clipboard/website-data permission prompt incorrectly g","CVE":"CVE-2026-118598","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"118598","Ordinal":"1","NoteData":"A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.\n\nIn src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:\n\n  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {\n\nBecause that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.\n\nA malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.\n\nRequirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.\n\nAffected: Epiphany >= 45.0 (bug present at least through 51.x).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976\nReporter acknowledgment: Fernando Munoz","Type":"Description","Title":"epiphany: clipboard/website-data permission prompt incorrectly g"}]}}}