CVE-2026-18487

MEDIUM 5.4

Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:[email protected]/](https://trusted.com:[email protected]/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

CWE	CWE-451
Vendor	gnome
Product	epiphany
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for gnome epiphany

Be the first to know when new medium vulnerabilities affecting gnome epiphany are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

GNOME / Epiphany

49.2 < *

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-18487 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2509570 gitlab.gnome.org: https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af gitlab.gnome.org: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897

Credits

Red Hat would like to thank Fernando Munoz for reporting this issue.