[From nobody Mon Nov 2 12:37:11 2026 Received: (at submit) by bugs.debian.org; 1 Nov 2026 19:53:17 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-108.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FROMDEVELOPER,MD5_SHA1_SUM,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 32; hammy, 149; neutral, 89; spammy, 1. spammytokens:0.977-+--click hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:33136) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xNbcC-000oSi-2m for submit@bugs.debian.org; Sun, 01 Nov 2026 19:53:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=SwnTM5WKr1FeaIWTsScHNTjHAL52K8lH9PCK7ImR4Bg=; b=MBpXCoO23YvLdSaCZF90U19ENP szIKlt+4kscBrqOvBYych5HclUY3Zr2kts0KU9cWF+IuWRg52oeJTgBOC8BhWUGYkX76Sl0GKv2gb NDRlQ3y/HVcx6geO/mv2h5rudLL1OJOjOCbhtoxVqowapHCgE698c7T/jw/iN6lOxWuYZjjEDK0ir dqoVWQmaCk1kRnQgpO4iCWYoo02xvndz2Y4iMVw19OMceB4IQEhbyK5YYlbi7gcpHjTHEkVZmcvgo JsS0QCryi0n7CxZS/5SNw3EpfJJnggf8MD0PyiIomkfUaW03OT8Y3bKOX6b6ZkjvueYHucm4lzFNq IgAFIBWQ==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xNbc8-005cep-2o for submit@bugs.debian.org; Sun, 01 Nov 2026 19:53:14 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id 39DAFDC12B7; Sun, 01 Nov 2026 20:53:12 +0100 (CET) Date: Sun, 1 Nov 2026 20:53:12 +0100 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: epiphany-browser: CVE-2026-118598 Message-ID: <aueYqNHcaCs-Egxy@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: epiphany-browser Version: 51.1-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Hi, The following vulnerability was published for epiphany-browser. CVE-2026-118598[0]: | A logic error in Epiphany's site permission handling can cause | camera and microphone access to be granted when the user only | approves a different permission. In src/ephy-window.c, | set_permission() stores the user's Allow/Deny choice after a WebKit | permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not | stored by ephy_permission_is_stored_by_permissions_manager(), so | control fell into an else-if that was written as: } else if | (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) { Because that | expression is a non-zero enum constant, the branch always ran for | those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM | and ACCESS_MICROPHONE for the site origin. The user only saw a | Clipboard or Website Data Access dialog. A malicious site that | obtains approval for clipboard or third-party storage access can | afterwards use getUserMedia without a further camera/microphone | prompt, exposing audiovisual confidentiality. Requirements: the | victim must visit a malicious page and click Allow on a clipboard or | website-data-access prompt. Affected: Epiphany >= 45.0 (bug present | at least through 51.x). Fixed: | https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 | (commit 480c3648). Upstream: | https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter | acknowledgment: Fernando Munoz If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-118598 https://www.cve.org/CVERecord?id=CVE-2026-118598 [1] https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 [2] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 [3] https://gitlab.gnome.org/GNOME/epiphany/-/commit/480c364890a996d893369b8e09e42e706140fc9e Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]