{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://gitlab.gnome.org/GNOME/epiphany","packageName":"epiphany","product":"Epiphany","source":"CNA: fedora","vendor":"GNOME","versions":[{"lessThan":"*","status":"affected","version":"45.0","versionType":"semver"}]}],"cveId":"CVE-2026-118598","cwes":["CWE-863"],"description":"A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.\n\nIn src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:\n\n  } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {\n\nBecause that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.\n\nA malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.\n\nRequirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.\n\nAffected: Epiphany >= 45.0 (bug present at least through 51.x).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976\nReporter acknowledgment: Fernando Munoz","epss":{"date":"2026-11-05","percentile":0.40725,"score":0.00469},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: fedora","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793972989339,"publishedAt":1793438974128,"references":[{"source":"CNA: fedora","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-118598"},{"source":"CNA: fedora","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562956"},{"source":"CNA: fedora","tags":[],"url":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976"},{"source":"CNA: fedora","tags":[],"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249"},{"source":"patrick@puiterwijk.org","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-118598"},{"source":"patrick@puiterwijk.org","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562956"},{"source":"patrick@puiterwijk.org","tags":[],"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249"},{"source":"patrick@puiterwijk.org","tags":[],"url":"https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976"}],"remediation":[{"kind":"workaround","source":"CNA: fedora","text":"Do not approve Clipboard or Website Data Access prompts on untrusted sites. Review and revoke camera and microphone site permissions in Epiphany (site permissions / privacy settings) for any origin where those prompts were accepted. Prefer browsing untrusted content with media devices disconnected or disabled at the OS level. Upgrade to a fixed Epiphany build containing MR !2249 / commit 480c3648 when available for your stream."}],"revision":"270a2f23afcd6e89ed0e91b71805ae7b36e01d3ed8cd2f99e8e41fef77cb53b0","sources":[{"modifiedAt":1793972989339,"name":"CNA: fedora","retrievedAt":1793974222610,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118598"},{"modifiedAt":1793648133347,"name":"NVD","retrievedAt":1793665749489,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118598"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793944804480,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118598"}],"ssvc":{"assessedAt":1793972980269,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access","updatedAt":1793974222610}