Epiphany
- Software type
- Web browser
- Total vulnerabilities (90 days)
- 3
en
As of 11/08/2026, Epiphany recorded 3 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Epiphany and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-118599epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension installCVE-2026-118598epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone accessCVE-2026-115683epiphany: TLS certificate warning bypass via race in tlsErrorPage message handlerCVE-2026-18487Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-118599epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install | Exploitation statusNot confirmed | FixNo | Published10/31/2026 | SeverityMedium |
CVE-2026-118598epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access | Exploitation statusNot confirmed | FixNo | Published10/31/2026 | SeverityMedium |
CVE-2026-115683epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler | Exploitation statusActively exploited | FixYes | Published10/30/2026 | SeverityMedium |
CVE-2026-18487Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host() | Exploitation statusNot exploited | FixNo | Published08/06/2026 | SeverityMedium |
4 Results | Page 1 of 1