Hi,

The following vulnerability was published for epiphany-browser.

CVE-2026-115683[0]:
| A race condition in Epiphany allows a malicious website to bypass
| the TLS/SSL certificate warning page.  Epiphany registers the main-
| world script message handler "tlsErrorPage" so its internal TLS
| error page can implement "Accept Risk and Proceed". The handler was
| registered immediately before loading the error page, leaving a
| brief window where the previously loaded untrusted origin could
| still call
| window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The
| only authorization check compares a numeric WebKit page id that
| increments predictably; an attacker can burst-guess ids and approve
| a certificate exception with no user click.  If a victim visits
| malicious site A that redirects to site B with an invalid
| certificate, site A can, for a few milliseconds, disable TLS
| certificate error warnings for host B until Epiphany is restarted,
| enabling man-in-the-middle or site spoofing for that host.  Upstream
| report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
| Proof of concept: https://beford.net/poc/ssl_poc.html Fix:
| https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245
| (register handlers on LOAD_COMMITTED). No fixed release tagged yet;
| reporter and maintainer describe all current versions as affected.
| Maintainer notes the risky registration timing dates to commit
| 1da1caed (Epiphany 45.x era); before that the handlers were always
| registered and similarly reachable from web content.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-115683
https://www.cve.org/CVERecord?id=CVE-2026-115683
[1] https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
[2] https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
epiphany-browser, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1152827@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated epiphany-browser package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 02 Nov 2026 13:13:58 +0100
Source: epiphany-browser
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 51.2-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1152824 1152825 1152827
Changes:
 epiphany-browser (51.2-1) unstable; urgency=high
 .
   * New upstream release
     - SECURITY UPDATE
     - CVE-2026-118598 Allowing a Clipboard or Website-Data-Access prompt
       grants camera AND microphone access (Closes: #1152824)
     - CVE-2026-118599 XPI extraction allows hard-link targets -  TAR .xpi
       overwrites an existing user file (Closes: #1152825)
     - CVE-2026-115683 TLS/SSL Error Page Bypass
       window.webkit.messageHandlers.tlsErrorPage (Closes: #1152827)
Checksums-Sha1:
 f6537f8cc57a08683a5403c9b1e6135bd2194ef0 2696 epiphany-browser_51.2-1.dsc
 22faa18fbdf7a07e28bfafbec0c0dc5258a902bd 4619612 epiphany-browser_51.2.orig.tar.xz
 8b79e0d131cdafb0515161d9593ae611f856cd91 44872 epiphany-browser_51.2-1.debian.tar.xz
 05ae94f4ea2ee5b9053819acc8685f72295cfda5 11665 epiphany-browser_51.2-1_source.buildinfo
Checksums-Sha256:
 9c6af929963aa8c5ba9ef49154a319c8ccca0cf784151c5776b03bdfdc29bee4 2696 epiphany-browser_51.2-1.dsc
 e45d93483d62beeb26b36b39fe2f8cb5511ffe6ddccc7fedff55b1e3cc0a5c30 4619612 epiphany-browser_51.2.orig.tar.xz
 ded726da11deb42f9648ed88f5f84c32a934c75248d8c19401b49284cb1c8f79 44872 epiphany-browser_51.2-1.debian.tar.xz
 81d8c52b4887fc9a6b743174ae0bc19f1adb72ecd11af8a39f60879c5bf49782 11665 epiphany-browser_51.2-1_source.buildinfo
Files:
 d40bce0834265cce9cc99dd77350b820 2696 gnome optional epiphany-browser_51.2-1.dsc
 f83b46ec377748346f4ba3450c95dba1 4619612 gnome optional epiphany-browser_51.2.orig.tar.xz
 8f782e96dc8e08ff33f9bb207ea476ea 44872 gnome optional epiphany-browser_51.2-1.debian.tar.xz
 c2cf51932a0732477e32bee83c283002 11665 gnome optional epiphany-browser_51.2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrofp4ACgkQ5mx3Wuv+
bH1Oxw//ekvUeLlP83pYxTIcQCKVFZ4TMCtAulWk0+8ncUAVN7z9ompsp72ISRKL
UdJqpCr0v6R72XAnVbFTHlcgrB8TSW23KswmjcwvFhz2xNW7pLJABi2DaqfchVy5
v93V3x1DV2EwWsZfjQXU4K3G5NFtjE4aE90rU/Pf4qGWJR9V6xu439L8Jdk5H5eP
G32L+H6y6Y5Y2/wiFMSTdInTq1KQFvSQ+OMr6HOWPJ4d4GVQf4NB0+cDOwA5s0Du
UkO37ZD2cQTxx/pO4aYPuVstfK3vFR/hZSts1IUw9XJ0ObTZ1Tjhu4oO1WT842D7
jE3LddSaDxatpADuZTM6Lhz/cQE/WsSBtMnUixaDGiSiqBEIMQDWWRrAW6UEzCiQ
yZveA/INpF90ZOYhyHjIgvUdasLC4QjbpbcZX4rYsLi2L/nHv0O6CP1Zgdifyaie
vdd/xuzFXaTaiMrmojTys5FosWnMCJ39tHAZFKvTZb1xctoU/dztdHV0efQ59SL/
fup1RfFBY+lJ/XddLR6VWknaL6ztXd1/lbLiurxvJ2M/zpnWWiJwckUAv0Vpcipp
UCh8PLIIKiZiMmLQVlpuXApnB0Tm3cTDfNI6UDO9guprX16x/7wP7/I8qfebH7ll
LV+G8jdvwO4wzUdDX8cdQVkxzLJ8F+Jq44Yx+qNZsqn890c2D1Y=
=lioa
-----END PGP SIGNATURE-----