Gnome

CVE-2026-115683: A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handle

CVE-2026-115683 Oct 30, 2026 Source: Vendor

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.

Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compar

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-115683

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1 matching , clear filters

CVE-2026-115683 BR2026-0000-039796 unclaimed

Credited as Red Hat would like to thank Fernando Munoz for reporting this issue