CVE-2026-18487
MEDIUM
5,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:[email protected]/](https://trusted.com:[email protected]/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0032
Percentile
0,2th
Updated
EPSS Score Trend (Last 2 Days)
451
User Interface (UI) Misrepresentation of Critical Information
DraftCommon Consequences
Security Scopes Affected:
Non-Repudiation
Access Control
Potential Impacts:
Hide Activities
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://access.redhat.com/security/cve/CVE-2026-18487
https://bugzilla.redhat.com/show_bug.cgi?id=2509570
https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433…
https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897