CVE-2026-118598: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-118598 is a logic error in the GNOME Epiphany (epiphany-browser) web browser's site permission handling that causes camera and microphone access to be silently granted when a user only approves a clipboard or website-data-access permission dialog. The flaw affects Epiphany versions 45.0 through at least 51.x. It was reported by Fernando Munoz and is estimated as HIGH severity by Feedly; Red Hat rates it Moderate due to the required user interaction (Red Hat CVE). The CVE was inserted into Feedly's database on 2026-10-28 and the status remains Reserved with no official CVSS score published at time of writing (Red Hat CVE).

The root cause is an incorrect authorization logic error (CWE-863) in src/ephy-window.c within the set_permission() function. When handling permission types CLIPBOARD and WEBSITE_DATA_ACCESS — which are not stored by ephy_permission_is_stored_by_permissions_manager() — control falls into an else-if branch that was written as } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {. Because this expression evaluates a non-zero enum constant (always truthy), the branch unconditionally executes for those permission types, writing EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user is only shown a clipboard or website-data-access dialog, never a camera/microphone prompt. A fix is available via GNOME GitLab MR !2249 (commit 480c3648) (Red Hat CVE).

A malicious website that tricks a user into clicking "Allow" on a clipboard or website-data-access permission dialog will silently and permanently gain getUserMedia access (camera and microphone) for that origin without any further prompt. This represents a significant confidentiality breach — audiovisual data from the victim's environment can be captured without their knowledge. There is no integrity or availability impact, and no privilege escalation beyond the browser process itself (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of writing. The CVE status remains Reserved and no EPSS score or CISA KEV listing is available. Exploitation requires deliberate user interaction — the victim must visit a malicious page and click "Allow" on a clipboard or website-data-access dialog — which limits opportunistic exploitation but does not eliminate targeted social-engineering scenarios (Red Hat CVE, Tenable Plugin).

1. Craft a malicious web page: Create a page that programmatically requests clipboard access (navigator.clipboard.readText()) or third-party storage access (document.requestStorageAccess()), triggering the browser's permission dialog.
2. Social-engineer the victim: Lure the victim to the malicious page using phishing, malvertising, or a compromised site, and present a convincing reason to click "Allow" on the clipboard or website-data-access prompt (e.g., "Click Allow to paste your coupon code").
3. Permission silently granted: Due to the logic error in set_permission(), Epiphany writes EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the attacker's origin — without any camera/microphone dialog being shown to the user.
4. Access camera and microphone: The attacker's page calls navigator.mediaDevices.getUserMedia({ video: true, audio: true }), which succeeds without a further prompt, enabling real-time audiovisual capture from the victim's device.
5. Exfiltrate media: Stream or upload captured audio/video to an attacker-controlled server using WebRTC or standard HTTP requests (Red Hat CVE).

• Browser Permissions: Unexpected camera and/or microphone permissions granted to unfamiliar origins in Epiphany's site permissions/privacy settings (Settings → Privacy → Website Permissions).
• Network: Outbound WebRTC or HTTP media streams to unknown external IP addresses originating from the Epiphany browser process.
• Process: The epiphany process accessing /dev/video* or /dev/snd/* devices without the user having explicitly approved a camera/microphone dialog.
• Logs: System audio/video device access logs (e.g., via udev or PipeWire/PulseAudio logs) showing Epiphany acquiring media devices during or after a clipboard/storage-access permission event (Red Hat CVE).

The upstream fix is available in GNOME GitLab MR !2249 (commit 480c3648); users should upgrade to a patched Epiphany build once it is available for their distribution stream. As an immediate workaround, Red Hat advises: (1) do not click "Allow" on clipboard or website-data-access prompts on untrusted sites; (2) review and revoke camera and microphone permissions in Epiphany's site permissions/privacy settings for any origin where such prompts were accepted; (3) prefer browsing untrusted content with media devices physically disconnected or disabled at the OS level (Red Hat CVE).

Red Hat has assessed the issue as Moderate severity, noting that while the confidentiality impact can be high, the requirement for deliberate user interaction limits overall risk. The vulnerability was reported by Fernando Munoz, who is acknowledged by Red Hat Product Security. No significant broader media coverage or notable researcher commentary beyond the upstream GNOME issue tracker and Red Hat advisory has been identified at this time (Red Hat CVE).