[From nobody Mon Nov 2 12:37:05 2026 Received: (at submit) by bugs.debian.org; 1 Nov 2026 19:57:18 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 29; hammy, 149; neutral, 103; spammy, 1. spammytokens:0.977-+--click hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:39136) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xNbg6-000pBU-0S for submit@bugs.debian.org; Sun, 01 Nov 2026 19:57:18 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=U+yjHVoWzuvJUfjzltugPOgYZIWck5AhMkuTZV26OBw=; b=C7FqF8NYnGtJ34+aGoZYvoyz7O 0E9scx9vm+eEbj8NaPOynD5YOFhGRqEfhNGHKG378s+fq6bnr82kr+9uFGIJPZ0pcGidJW3REYsGA p1RloQpx6tx6GRD5vfMKeszdgbJCf2kiyj41jDTghDUdBnwdxKo/dX2Dm8evwqg2g4C8jWoba+mdS 0ZXHC75RKlPNlMKCamcYMWNLiNMCqvGVBsgsXrGresT8yJRO+VH37arOXKbS5nr63zy/Z93IgoVJe VfJM2rHN0Al/tOIe1TuxCAhvSMHLEQCnYU/va1erNA0hY5lWTAuHMH+zW8RRjpuqnllOL4fpiVbsD 7ZUSqjZw==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xNbg2-005cnk-31 for submit@bugs.debian.org; Sun, 01 Nov 2026 19:57:16 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id 88D47DC12B7; Sun, 01 Nov 2026 20:57:14 +0100 (CET) Date: Sun, 1 Nov 2026 20:57:14 +0100 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: epiphany-browser: CVE-2026-115683 Message-ID: <aueZmvCK4OfCWffM@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: epiphany-browser Version: 51.1-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Hi, The following vulnerability was published for epiphany-browser. CVE-2026-115683[0]: | A race condition in Epiphany allows a malicious website to bypass | the TLS/SSL certificate warning page. Epiphany registers the main- | world script message handler "tlsErrorPage" so its internal TLS | error page can implement "Accept Risk and Proceed". The handler was | registered immediately before loading the error page, leaving a | brief window where the previously loaded untrusted origin could | still call | window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The | only authorization check compares a numeric WebKit page id that | increments predictably; an attacker can burst-guess ids and approve | a certificate exception with no user click. If a victim visits | malicious site A that redirects to site B with an invalid | certificate, site A can, for a few milliseconds, disable TLS | certificate error warnings for host B until Epiphany is restarted, | enabling man-in-the-middle or site spoofing for that host. Upstream | report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 | Proof of concept: https://beford.net/poc/ssl_poc.html Fix: | https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 | (register handlers on LOAD_COMMITTED). No fixed release tagged yet; | reporter and maintainer describe all current versions as affected. | Maintainer notes the risky registration timing dates to commit | 1da1caed (Epiphany 45.x era); before that the handlers were always | registered and similarly reachable from web content. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115683 https://www.cve.org/CVERecord?id=CVE-2026-115683 [1] https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 [2] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]