CVE-2026-115683: epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
[Unknown description]
Other sources
A race condition in Epiphany allows a malicious website to bypass the ...
— Debian
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
A victim must visit a malicious site that redirects to a target host with an invalid TLS certificate. The attacker must act during the brief interval after Epiphany registers the tlsErrorPage handler and before its internal error page loads, then burst-guess predictable WebKit page IDs; no privileges or user click are required.
Who is exposed to this issue?
Users of Epiphany Browser on Ubuntu or Debian are exposed when browsing attacker-controlled content that can redirect them to a host presenting an invalid certificate. The issue is network-reachable through malicious web content and requires user interaction in the form of visiting the malicious site.
What is the impact after a successful bypass?
The attacker can approve a certificate exception for the redirected-to host without the user selecting "Accept Risk and Proceed." TLS certificate warnings for that host can remain disabled until Epiphany is restarted, allowing man-in-the-middle attacks or spoofing of that host.
Does restarting the browser remove the malicious certificate exception?
Yes. The described certificate-warning bypass for the affected host lasts until Epiphany is restarted.