Source: epiphany-browser Version: 51.1-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
Hi, The following vulnerability was published for epiphany-browser. CVE-2026-115683[0]: | A race condition in Epiphany allows a malicious website to bypass | the TLS/SSL certificate warning page. Epiphany registers the main- | world script message handler "tlsErrorPage" so its internal TLS | error page can implement "Accept Risk and Proceed". The handler was | registered immediately before loading the error page, leaving a | brief window where the previously loaded untrusted origin could | still call | window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The | only authorization check compares a numeric WebKit page id that | increments predictably; an attacker can burst-guess ids and approve | a certificate exception with no user click. If a victim visits | malicious site A that redirects to site B with an invalid | certificate, site A can, for a few milliseconds, disable TLS | certificate error warnings for host B until Epiphany is restarted, | enabling man-in-the-middle or site spoofing for that host. Upstream | report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 | Proof of concept: https://beford.net/poc/ssl_poc.html Fix: | https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 | (register handlers on LOAD_COMMITTED). No fixed release tagged yet; | reporter and maintainer describe all current versions as affected. | Maintainer notes the risky registration timing dates to commit | 1da1caed (Epiphany 45.x era); before that the handlers were always | registered and similarly reachable from web content. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115683 https://www.cve.org/CVERecord?id=CVE-2026-115683 [1] https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 [2] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
