Medium severity · published Aug 6, 2026
CVE-2026-18487
Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Epiphany · GNOME
49.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18487
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18487
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-18487
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2509570
gitlab.gnome.org
https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af
gitlab.gnome.org
https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897
More from Epiphany
8.1
CVE-2019-6251
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections
7.5
CVE-2023-26081
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts
7.5
CVE-2022-29536
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title
7.5
CVE-2018-12016
libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write…
7.5
CVE-2018-11396
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that…