GNOME Epiphany Browser Permission Bypass and Unauthorized Camera/Microphone Access Vulnerability (CVE-2026-118598)

1. Vulnerability Overview & Root Cause

A logic error in GNOME Epiphany's site permission handling leads to an unauthorized permission bypass (CWE-863). In src/ephy-window.c, the set_permission() function processes and stores the user's Allow/Deny choices following a WebKit permission dialog. Because permission types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), the control flow falls into an exception branch. This branch was incorrectly written as else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE). Since this expression evaluates to a non-zero enum constant, the condition always resolves to true, causing the browser to write EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must host a malicious webpage and entice the victim to visit it. The malicious site triggers a prompt requesting access to either the clipboard or website data. Once the victim clicks 'Allow' on this prompt, the flawed logic in set_permission() automatically grants the site permission to access the camera and microphone. Subsequently, the malicious site can invoke the getUserMedia API to capture audio and video streams without displaying any further permission prompts or warnings to the user.

3. Infrastructure & Business Impact

This vulnerability poses a severe threat to user privacy and corporate confidentiality. If an employee uses an affected version of Epiphany to access an untrusted external site, sensitive conversations or physical office environments could be monitored without authorization. Although user interaction is required to trigger the initial prompt, the high likelihood of users granting clipboard or data access on modern web applications makes this a highly practical and dangerous attack vector.