Every CVE Search/ Get API key

CVE-2026-18487

Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

5.4 MediumFix available

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.34%Unchanged since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Record
CVE-2026-18487
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-451
Updated
2026-11-02
EUVDEUVD-2026-54296 5.4

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Record
EUVD-2026-54296
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5w7g-jqwx-788x 5.4

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to...

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Record
GHSA-5w7g-jqwx-788x
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-451
Updated
2026-11-02
NVD 5.4

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Record
CVE-2026-18487
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-451
Updated
2026-11-02
OSV 5.4

Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Record
CVE-2026-18487
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-451
Updated
2026-11-04
OSVDEBIAN-CVE-2026-18487 5.4

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Record
DEBIAN-CVE-2026-18487
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-18487 5.4

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:[email protected]/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Record
UBUNTU-CVE-2026-18487
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:12361-1 No score

epiphany-51.1-1.1 on GA media

These are all security issues fixed in the epiphany-51.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12361-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
epiphany-browser
Debian:12
 All versions, plus listed versions
43.1-144.0-144.1-144.2-144.3-1
Show 42 moreShow less
44.5-144.5-244.6-144~rc-145.0-145.1-145.2-145~beta-146.0-146.0-246.1-146.2-146.3-146~alpha-146~beta-147.0-147.2-147~beta-147~rc-148.0-148.1-148.2-148.3-148.3-248.5-148.5-248.5-348~beta-148~rc-148~rc-249.0-149.1-149.2-149.2-249.2-350.3-150.3-250.4-150.4-251.0-151.1-151~rc-1
 None known
epiphany-browser
Debian:13
 All versions, plus listed versions
48.3-248.5-0+deb13u148.5-148.5-248.5-3
Show 12 moreShow less
49.0-149.1-149.2-149.2-249.2-350.3-150.3-250.4-150.4-251.0-151.1-151~rc-1
 None known
epiphany-browser
Debian:14
 before 51~rc-1, plus listed versions
48.3-248.5-148.5-248.5-349.0-1
Show 8 moreShow less
49.1-149.2-149.2-249.2-350.3-150.3-250.4-150.4-2
51~rc-1
epiphany-browser
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.16.3-1ubuntu13.18.0-1ubuntu23.18.1-1ubuntu13.18.3-0ubuntu13.18.5-0ubuntu13.18.5-0ubuntu1.13.18.10-0ubuntu13.18.11-0ubuntu1
 None known
epiphany-browser
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.26.1-1ubuntu13.26.1-1ubuntu23.26.1-1ubuntu43.26.5.1-1ubuntu13.27.90-1ubuntu1
Show 4 moreShow less
3.28.0.1-1ubuntu13.28.1-1ubuntu13.28.5-0ubuntu13.28.6-0ubuntu1
 None known
epiphany-browser
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.34.1-13.34.1-1build13.36.0-13.36.1-13.36.2-0ubuntu13.36.3-0ubuntu13.36.4-0ubuntu13.36.4-0ubuntu2
 None known
epiphany-browser
Ubuntu:22.04:LTS
 All versions, plus listed versions
41.0-141.0-241.2-141.3-142~beta-1
Show 4 moreShow less
42.0-142.1-142.1-1ubuntu142.4-0ubuntu1
 None known
epiphany-browser
Ubuntu:24.04:LTS
 All versions, plus listed versions
45.0-145.1-146~alpha-146~beta-146.0-146.0-2build146.5-0ubuntu1
 None known
epiphany-browser
Ubuntu:26.10
 All versions, plus listed versions
49.2-3ubuntu150.4-150.4-2
 None known
epiphany-browser
Ubuntu:26.04:LTS
 All versions, plus listed versions
48.5-349.1-149.2-149.2-249.2-349.2-3ubuntu1
 None known
epiphany
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 51.1-1.1
51.1-1.1

History

History
RecordedChangedSources
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18487 is a medium vulnerability (CVSS 5.4) in Gnome Epiphany, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in epiphany-browser 51~rc-1.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open