Is CVE-2026-118598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118598 being exploited in the wild.

How severe is CVE-2026-118598?

Medium severity, with a CVSS score of 6.5, published 31 October 2026.

Which products and versions are affected?

Gnome Epiphany 45.0 through 51.x.

How is CVE-2026-118598 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118598?

Check whether you run Gnome Epiphany at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118598: GNOME Epiphany logic error in site permission handling

CVE-2026-118598 · Severity: medium · CVSS 6.5 · Published 2026-10-31

Epiphany is a web browser used to access websites. A logic error in how it handles permission requests allows a malicious website to secretly grant itself access to the user's camera and microphone when the user only intended to approve access to clipboard or website storage. An attacker could silently record audio and video from victims who visit a malicious site and approve a seemingly benign permission prompt.

Technologies: Gnome Epiphany. Vendors: Gnome.

Quick answers

Is CVE-2026-118598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118598 being exploited in the wild.
How severe is CVE-2026-118598?: Medium severity, with a CVSS score of 6.5, published 31 October 2026.
Which products and versions are affected?: Gnome Epiphany 45.0 through 51.x.
Is there a fix for CVE-2026-118598?: Yes: fixed in Epiphany with merge request 2249 / commit 480c3648. Until then: Do not approve Clipboard or Website Data Access prompts on untrusted sites. Review and revoke camera and microphone permissions in Epiphany's privacy settings for any origin where such prompts were accepted. Prefer browsing untrusted content with media devices disconnected or disabled at the OS level. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118598 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118598?: Check whether you run Gnome Epiphany at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Epiphany with merge request 2249 / commit 480c3648

Do not approve Clipboard or Website Data Access prompts on untrusted sites. Review and revoke camera and microphone permissions in Epiphany's privacy settings for any origin where such prompts were accepted. Prefer browsing untrusted content with media devices disconnected or disabled at the OS level.

Technical details

The vulnerability is a logic error in set_permission() in src/ephy-window.c where an else-if branch checking for EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE was written as a non-zero enum constant instead of a proper condition, causing it to always execute for clipboard and website-data-access permissions. This causes EPHY_PERMISSION_PERMIT to be written for both ACCESS_WEBCAM and ACCESS_MICROPHONE when the user only approved a different permission type. Exploitation requires user interaction: visiting a malicious site and clicking Allow on a clipboard or website-data-access dialog, after which the site gains silent camera and microphone access.

Affected products

GNOME Epiphany 45.0 through 51.x

Timeline

2026-10-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.