CVE-2025-3839: 
Linux Debian vulnerability analysis and mitigation

A security vulnerability was identified in Epiphany browser (CVE-2025-3839) that allows websites to open external URL handler applications with minimal user interaction. The vulnerability was discovered and reported on April 21, 2025, affecting multiple versions of the Epiphany browser across various Linux distributions (Debian Tracker, Ubuntu Security).

The vulnerability relates to the URL handling mechanism in Epiphany browser, where external applications can be triggered to open URLs without proper user interaction validation. The issue has been confirmed to affect multiple versions of the browser, including those in Debian distributions from Bullseye through Sid, and Ubuntu releases from 16.04 LTS through 25.04 (Debian Tracker).

The vulnerability could potentially allow malicious websites to trigger external applications without proper user consent, which could lead to unauthorized application execution or unintended system behavior (Debian Tracker).

A fix has been implemented and is available in Epiphany browser version 48.1-1 and later. The fix was implemented through two commits: 324e25caee659bce43ff5c614d105f64899dfb7f (version 48.1) and 9f80e7e80b75212627790d74041d46eedb6e321e (version 47.5) (Debian Tracker).