CVE-2026-94291: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-94291 is an insecure iframe framing vulnerability in Epiphany (GNOME Web) that allows remote attackers to exfiltrate local files from a user's system. The flaw exists because the ephy-reader and view-source URI schemes are not registered as display-isolated, enabling malicious web pages to embed these schemes in iframes from an HTTP context. The CVE status is currently "Reserved" and was published on September 18, 2026. It is estimated to be of Medium severity (CWE-863: Incorrect Authorization) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization): Epiphany registers custom URI schemes (ephy-reader, view-source, ephy-webextension) without marking them as display-isolated via WebKit's security manager API. This omission bypasses WebKit's normal framing security controls, allowing any HTTP web page to embed these privileged schemes inside <iframe> elements. Because ephy-reader and view-source can access local file content, an attacker-controlled page can read and exfiltrate files from the victim's filesystem. The upstream fix (commit 25e1828903cb2419e18c437723b0f87fb5d31780) addresses this by calling webkit_security_manager_register_uri_scheme_as_display_isolated() for the affected schemes (Red Hat Bugzilla).

Successful exploitation allows a remote attacker to exfiltrate arbitrary local files accessible to the user running Epiphany, purely by luring the victim to visit a malicious website — no additional authentication or privileges are required beyond user interaction. The confidentiality impact is significant, as sensitive files (e.g., SSH keys, configuration files, documents) could be read and transmitted to an attacker-controlled server. Integrity and availability are not directly affected by this vulnerability (Red Hat Bugzilla, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. Exploitation requires only that a user visit a malicious website using a vulnerable version of Epiphany (GNOME Web), making the attack surface relatively broad for GNOME desktop users. The CVE is detected by Nessus plugin 362866. No CISA KEV listing or threat actor attribution has been identified (Tenable Nessus, Red Hat CVE).

1. Reconnaissance: Identify potential victims using Epiphany (GNOME Web) browser, which is the default browser in GNOME desktop environments on Linux distributions such as Fedora and Ubuntu GNOME.
2. Craft malicious web page: Create an HTML page containing an <iframe> element with its src attribute set to a ephy-reader:// or view-source:// URI pointing to a target local file (e.g., view-source:///etc/passwd or ephy-reader:///home/user/.ssh/id_rsa).
3. Host and deliver: Host the malicious page on an attacker-controlled server and lure the victim to visit it via phishing, malvertising, or a compromised website.
4. Exfiltrate data: Once the victim loads the page in Epiphany, the iframe renders the local file content within the attacker's page context, enabling JavaScript on the page to read the iframe's content and transmit it to the attacker's server (Red Hat Bugzilla).

• Network: Outbound HTTP/HTTPS POST requests from the user's machine to unknown external servers shortly after visiting an unfamiliar website, potentially containing encoded file content in the request body.
• Logs: Browser or system logs showing access to ephy-reader:// or view-source:// URIs initiated from a third-party web page context rather than direct user navigation.
• Process: Epiphany renderer process accessing sensitive local files (e.g., files in ~/.ssh/, ~/.gnupg/, or /etc/) without explicit user action.

The upstream fix is available via GNOME Epiphany commit 25e1828903cb2419e18c437723b0f87fb5d31780, which registers the affected URI schemes as display-isolated. Users should update Epiphany (GNOME Web) to a version that includes this patch as soon as it is available in their distribution's package repositories. As a workaround, users can avoid using Epiphany as their primary browser or disable JavaScript on untrusted sites until a patched package is available (Red Hat Bugzilla, GNOME GitLab Fix).

Coverage of this vulnerability has been limited but noted in Linux-focused media. Linuxiac reported on the GNOME 51.1 release that included security fixes, referencing this issue (Linuxiac). Linux Compatible also covered the GNOME 51.1 release in the context of security patches (Linux Compatible). No significant researcher commentary or social media discussion has been identified beyond standard vulnerability tracking.