UBUNTU-CVE-2026-118598: Medium severity ubuntu/epiphany-browser vulnerability
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission() stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITEDATAACCESS are not stored by ephypermissionisstoredbypermissionsmanager(), so control fell into an else-if that was written as: } else if (EPHYPERMISSIONTYPEACCESSWEBCAMANDMICROPHONE) { Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHYPERMISSIONPERMIT for both ACCESSWEBCAM and ACCESSMICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality. Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt. Affected: Epiphany >= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/mergerequests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/workitems/2976 Reporter acknowledgment: Fernando Munoz
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Epiphanyto a version that resolves this vulnerability.Patch 480c3648
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Epiphany versions 45.0 and later, including versions in the 51.x series where the bug was present, are exposed when they visit a malicious site and approve a Clipboard or Website Data Access permission request.
What must an attacker do to obtain camera or microphone access?
The attacker must convince the victim to click Allow on a Clipboard or Website Data Access prompt from a malicious page. After that approval, the site can request getUserMedia and receive camera and microphone access without another camera or microphone prompt.
Are camera and microphone permissions granted by default?
No. Exploitation requires an explicit user approval of a Clipboard or Website Data Access permission dialog. The issue is that this approval is incorrectly recorded as permission for both the camera and microphone.
What can be done if the fix cannot be applied immediately?
Avoid approving Clipboard or Website Data Access permission prompts from untrusted sites, especially where the request is unexpected. Treat sites previously granted either permission as potentially able to access the camera and microphone without a new prompt.