CVE-2026-115683: GNOME Epiphany TLS certificate warning bypass via race condition

CVE-2026-115683 · Severity: medium · CVSS 6.8 · Published 2026-10-30

Epiphany is a web browser used to access websites. A race condition in how it handles security certificate warnings allows a malicious website to trick the browser into bypassing these warnings, enabling an attacker to spoof legitimate websites or intercept traffic without user interaction. An attacker on a malicious site can suppress certificate warnings for other sites for the duration of the browsing session.

Technologies: Gnome Epiphany. Vendors: Gnome.

Quick answers

Is CVE-2026-115683 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115683 being exploited in the wild.
How severe is CVE-2026-115683?
Medium severity, with a CVSS score of 6.8, published 30 October 2026.
Which products and versions are affected?
Gnome Epiphany all versions as of 2026-10-30.
Is there a fix for CVE-2026-115683?
No fixed version is recorded yet. Until a patched version is installed, avoid following links from untrusted sites to HTTPS destinations and do not rely on Epiphany for sensitive sites when browsing untrusted content. Restarting the browser clears any attacker-installed certificate exceptions for the session. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-115683 attacked?
It is attacked over the network.
Am I affected by CVE-2026-115683?
Check whether you run Gnome Epiphany at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Until a patched version is installed, avoid following links from untrusted sites to HTTPS destinations and do not rely on Epiphany for sensitive sites when browsing untrusted content. Restarting the browser clears any attacker-installed certificate exceptions for the session.

Technical details

A TOCTOU race condition exists in Epiphany's TLS error page handler registration: the "tlsErrorPage" message handler is registered immediately before loading the error page, creating a window where a previously loaded untrusted origin can still invoke the handler. Authorization checks rely only on a predictably incrementing numeric WebKit page ID, which an attacker can burst-guess. This allows unprompted certificate exception approval for any target host until browser restart.

Affected products

  • GNOME Epiphany all versions as of 2026-10-30

Timeline

  • 2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.