{"id":"CVE-2023-26081","aliases":["DEBIAN-CVE-2023-26081","DLA-3423-1","EUVD-2023-29955","GHSA-cw64-pq7m-342r","GHSA-mhhf-w9xw-pp9x","MGASA-2023-0099","OESA-2023-1139","OESA-2023-1175","UBUNTU-CVE-2023-26081","openSUSE-SU-2024:12722-1"],"status":"published","title":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating...","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01228,"percentile":0.69244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668"],"published":"2023-02-20T00:00:00Z","modified":"2026-11-04T02:46:06Z","fixes":[{"ecosystem":"Debian:12","package":"epiphany-browser","fixed_in":["43.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"epiphany-browser","fixed_in":["43.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"epiphany-browser","fixed_in":["43.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"epiphany-browser","fixed_in":["3.32.1.2-3~deb10u3"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"epiphany","fixed_in":["3.38.2-1.3.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"epiphany","fixed_in":["40.6-3.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"epiphany","fixed_in":["40.6-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"epiphany","fixed_in":["43.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.1.2-3~deb10u3"}]}],"versions":["3.32.1.2-2","3.32.1.2-3~deb10u1","3.32.1.2-3~deb10u2"]},{"source":"osv","ecosystem":"Mageia:8","package":"epiphany","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2-1.3.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"epiphany","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.6-3.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"epiphany","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.6-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.3-1ubuntu1","3.18.0-1ubuntu2","3.18.1-1ubuntu1","3.18.3-0ubuntu1","3.18.5-0ubuntu1","3.18.5-0ubuntu1.1","3.18.10-0ubuntu1","3.18.11-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-1ubuntu1","3.26.1-1ubuntu2","3.26.1-1ubuntu4","3.26.5.1-1ubuntu1","3.27.90-1ubuntu1","3.28.0.1-1ubuntu1","3.28.1-1ubuntu1","3.28.5-0ubuntu1","3.28.6-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-1","3.34.1-1build1","3.36.0-1","3.36.1-1","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.4-0ubuntu1","3.36.4-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["41.0-1","41.0-2","41.2-1","41.3-1","42~beta-1","42.0-1","42.1-1","42.1-1ubuntu1","42.4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["45.0-1","45.1-1","46~alpha-1","46~beta-1","46.0-1","46.0-2build1","46.5-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.0-1","48.3-1","48.3-2","48.3-2build1","48.5-1","48.5-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["49.2-3ubuntu1","50.4-1","50.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.5-3","49.1-1","49.2-1","49.2-2","49.2-3","49.2-3ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"epiphany","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.1-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"epiphany"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1275","tags":["x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x","tags":["x_transferred","Exploit","Third Party Advisory","advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SADQCSQKTJKTTIJMEPY7GII6IVQSKEKV/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFWUNG6E4ZT43EYNHKYXS7QVSO2VW2H2/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00015.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26081","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFWUNG6E4ZT43EYNHKYXS7QVSO2VW2H2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SADQCSQKTJKTTIJMEPY7GII6IVQSKEKV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFWUNG6E4ZT43EYNHKYXS7QVSO2VW2H2"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SADQCSQKTJKTTIJMEPY7GII6IVQSKEKV"},{"url":"https://github.com/advisories/GHSA-cw64-pq7m-342r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26081.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26081","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0099.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31609","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SADQCSQKTJKTTIJMEPY7GII6IVQSKEKV/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1139","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1175","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-26081","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26081","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26081","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-26081","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2025-03-18T15:00:49.464Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:35:15.066338Z"}],"euvd":[{"id":"EUVD-2023-29955","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2025-03-18T15:00:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:00.464245Z"}],"ghsa":[{"id":"GHSA-cw64-pq7m-342r","title":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating...","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","status":"published","published":"2023-02-20T03:30:18Z","modified":"2025-03-18T15:31:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:00:20.032115Z"}],"nvd":[{"id":"CVE-2023-26081","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","status":"published","published":"2023-02-20T03:15:10.313Z","modified":"2026-06-17T05:42:38.257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"CVE-2023-26081","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2026-11-04T02:46:06.864162274Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-04T02:54:00.554175Z"},{"id":"DEBIAN-CVE-2023-26081","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","status":"published","published":"2023-02-20T03:15:10.313Z","modified":"2026-10-26T18:02:12.697097596Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"OESA-2023-1139","title":"epiphany security update","description":"Epiphany is the web browser for the GNOME desktop. Its goal is to be simple and easy to use. Epiphany ties together many GNOME components in order to let you focus on the Web content, instead of the browser application.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.(CVE-2023-26081)","status":"published","published":"2023-03-04T11:05:37Z","modified":"2026-08-18T01:17:37.346051666Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1175","title":"epiphany security update","description":"Epiphany is the web browser for the GNOME desktop. Its goal is to be simple and easy to use. Epiphany ties together many GNOME components in order to let you focus on the Web content, instead of the browser application.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.(CVE-2023-26081)","status":"published","published":"2023-03-17T11:05:39Z","modified":"2026-08-18T01:17:38.60747136Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2023-26081","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.","status":"published","published":"2023-02-20T03:15:00Z","modified":"2026-10-17T12:56:04.513298354Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"DLA-3423-1","title":"epiphany-browser - security update","status":"published","published":"2023-05-15T00:00:00Z","modified":"2026-03-09T01:21:58.40782Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2023-0099","title":"Updated epiphany packages fix security vulnerability","description":"In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick\nusers into exfiltrating passwords, because autofill occurs in sandboxed\ncontexts. (CVE-2023-26081)\n","status":"published","published":"2023-03-18T22:16:28Z","modified":"2026-04-16T04:43:22.710502084Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12722-1","title":"epiphany-43.1-1.1 on GA media","description":"These are all security issues fixed in the epiphany-43.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:37:06.406511Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}