A flaw was found in Epiphany.

CVE-2026-18487 is an address bar spoofing flaw in GNOME Web (Epiphany). By crafting a URL with a colon-based authority confusion pattern — e.g. https://trusted.com:[email protected]/ — an attacker can make the address bar and site-identity UI display trusted.com while the browser actually loads content from attacker.com. The flaw is rooted in improper URL parsing (CWE-451, UI Misrepresentation of Critical Information). All versions of Epiphany prior to the fix commit (0dde1d3694) on GNOME GitLab are affected. The CVSS vector confirms no privilege requirement, network-reachable, but requires a victim to click a malicious link. Impact is rated C:L/I:L/A:N — no code execution, no persistence, just visual deception.

The vendor's MEDIUM / 5.4 score is *technically accurate in a vacuum* but dramatically overstates real-world risk. Epiphany does not appear in any mainstream browser market-share tracker — it is used almost exclusively on hobbyist GNOME Linux desktops and a handful of embedded kiosk setups. In a 10,000-host enterprise, the probability that even a single managed endpoint runs Epiphany as its primary browser rounds to zero. The flaw enables phishing, not code execution, and modern email-gateway link rewriting and endpoint DNS filtering would further blunt even the theoretical attack. Calling this MEDIUM implies it deserves scheduled remediation attention alongside real threats — it does not.

Why this verdict

• Near-zero enterprise footprint: Epiphany does not appear in any mainstream browser market-share dataset. In a typical 10,000-host enterprise running Windows/macOS with Chrome or Edge, the expected number of Epiphany users is zero.
• Impact ceiling is phishing, not compromise: The flaw enables address bar spoofing only. There is no code execution, no privilege escalation, no persistence. The attacker gains, at best, credentials that MFA should protect.
• Role multiplier: Epiphany is a *desktop web browser* on Linux. It is not a server component, identity provider, hypervisor, backup system, or any high-value-role software. (a) Low-value role — hobbyist GNOME desktop: chain succeeds, blast radius is one user's credentials. (b) Typical role — N/A, browsers are client software. (c) High-value role — theoretically a kiosk browser on a locked-down terminal, but even then the impact is UI deception, not system compromise. No high-value-role floor applies.
• No exploitation activity, no PoC weaponization, bottom-tier EPSS: The 0.00318 EPSS score and absence from KEV confirm that the threat-intel community sees no reason to prioritize this.

Why not higher?

The vendor's MEDIUM score assumes a generic browser population. In the real world, Epiphany's installed base is so small that the vulnerability's reach is negligible. Even if exploited, the impact is limited to UI spoofing for credential phishing — there is no code execution or system compromise path. No active exploitation or weaponized PoCs exist. None of these factors justify MEDIUM or above.

Why not lower?

Dropping to IGNORE would require the flaw to have no security consequence whatsoever. The spoofing mechanic is real and functional — a user who *does* run Epiphany *can* be deceived. Some Linux distributions ship Epiphany as a default GNOME component, so a nonzero (if tiny) population exists. The flaw merits documentation and eventual patching, just not priority attention.

1. Confirm Epiphany is not installed on managed endpoints — Run a software inventory query across your fleet. If Epiphany (epiphany-browser / gnome-web) is not present — which is the overwhelmingly likely outcome in enterprise — document it and close this CVE as not-applicable. No mitigation SLA applies for LOW severity.
2. Remove or replace Epiphany where found — If any managed Linux desktops have Epiphany installed, replace it with Firefox ESR or Chrome. This eliminates the attack surface entirely and aligns with enterprise browser standardization policy.
3. Apply distro package update when available — Once Fedora, Ubuntu, or Debian ship the backported fix, include it in your normal patch cycle. For LOW severity under noisgate SLA, this is backlog hygiene with no hard deadline.

Run this on any Linux host where you want to check if Epiphany is installed and whether the installed version contains the fix. No special privileges needed. Example: bash check_epiphany_cve2026_18487.sh

#!/usr/bin/env bash
# check_epiphany_cve2026_18487.sh
# Checks whether GNOME Web (Epiphany) is installed and whether
# the CVE-2026-18487 fix commit is present in the installed version.
# Exit codes: 0 = PATCHED or NOT INSTALLED, 1 = VULNERABLE, 2 = UNKNOWN

FIX_COMMIT="0dde1d369458ac5c44b74b5ad3c433f825f6f8af"

# Check if epiphany is installed
if ! command -v epiphany &>/dev/null && ! dpkg -l epiphany-browser 2>/dev/null | grep -q '^ii' && ! rpm -q epiphany 2>/dev/null | grep -qv 'not installed'; then
  echo "PATCHED — Epiphany is not installed on this host. CVE-2026-18487 does not apply."
  exit 0
fi

# Get installed version
VERSION=""
if command -v epiphany &>/dev/null; then
  VERSION=$(epiphany --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.?[0-9]*' | head -1)
elif dpkg -l epiphany-browser 2>/dev/null | grep -q '^ii'; then
  VERSION=$(dpkg -l epiphany-browser 2>/dev/null | awk '/^ii/{print $3}' | head -1)
elif rpm -q epiphany &>/dev/null; then
  VERSION=$(rpm -q epiphany --queryformat '%{VERSION}' 2>/dev/null)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Epiphany appears installed but version could not be determined."
  echo "Manually verify the fix commit $FIX_COMMIT is included."
  exit 2
fi

echo "Epiphany version detected: $VERSION"

# Check distro changelog for fix commit (Debian/Ubuntu)
if [ -f /usr/share/doc/epiphany-browser/changelog.Debian.gz ]; then
  if zgrep -q "$FIX_COMMIT" /usr/share/doc/epiphany-browser/changelog.Debian.gz 2>/dev/null; then
    echo "PATCHED — Fix commit $FIX_COMMIT found in package changelog."
    exit 0
  fi
fi

# Check RPM changelog (Fedora/RHEL)
if rpm -q epiphany &>/dev/null; then
  if rpm -q --changelog epiphany 2>/dev/null | grep -q "$FIX_COMMIT"; then
    echo "PATCHED — Fix commit $FIX_COMMIT found in RPM changelog."
    exit 0
  fi
fi

echo "VULNERABLE — Epiphany $VERSION is installed and the fix commit was not found."
echo "Update epiphany to a version containing commit $FIX_COMMIT or remove the browser."
exit 1

Sources

1. Tenable CVE-2026-18487
2. GNOME Epiphany Security Vulnerabilities 2026 — stack.watch
3. GNOME Epiphany GitLab Repository
4. CVE Details — GNOME Epiphany
5. Browser Market Share 2026 — DemandSage
6. Browser Market Share 2026 — Backlinko
7. CISA Known Exploited Vulnerabilities Catalog