CVE-2026-118598

Name of the Vulnerable Software and Affected Versions Epiphany versions 45.0 through 51.x

Description A logic error in site permission handling occurs within the set permission() function in src/ephy-window.c. When a user interacts with a WebKit permission dialog for CLIPBOARD or WEBSITE DATA ACCESS, the system incorrectly executes a branch intended for camera and microphone access. This results in the application granting EPHY PERMISSION PERMIT for both ACCESS WEBCAM and ACCESS MICROPHONE without the user's knowledge. Consequently, a malicious site that obtains approval for clipboard or third-party storage access can use getUserMedia() to access the camera and microphone without further prompts, compromising audiovisual confidentiality.

Recommendations Update Epiphany to a version that includes the fix from commit 480c3648.