{
  "cveId": "CVE-2026-118598",
  "url": "https://patchblox.com/security/cve/CVE-2026-118598",
  "summary": "CVE-2026-118598 is fixed in epiphany-browser on 1 platform by DEBIAN-CVE-2026-118598 (version 51.2-1), released November 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "epiphany-browser: A logic error in Epiphany\u0027s site permission handling can cause camera and microphone access to be granted when the us...",
  "description": "A logic error in Epiphany\u0027s site permission handling can cause camera and microphone access to be granted when the user only approves a different permission.  In src/ephy-window.c, set_permission() stores the user\u0027s Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored by ephy_permission_is_stored_by_permissions_manager(), so control fell into an else-if that was written as:    } else if (EPHY_PERMISSION_TYPE_ACCESS_WEBCAM_AND_MICROPHONE) {  Because that expression is a non-zero enum constant, the branch always ran for those types and wrote EPHY_PERMISSION_PERMIT for both ACCESS_WEBCAM and ACCESS_MICROPHONE for the site origin. The user only saw a Clipboard or Website Data Access dialog.  A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt, exposing audiovisual confidentiality.  Requirements: the victim must visit a malicious page and click Allow on a clipboard or website-data-access prompt.  Affected: Epiphany \u003E= 45.0 (bug present at least through 51.x). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2249 (commit 480c3648). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2976 Reporter acknowledgment: Fernando Munoz",
  "published": "2026-10-31T10:16:37Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
  "epss": 0.00469,
  "epssPercentile": 0.40835,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "epiphany-browser",
      "release": "Debian 14",
      "fixedVersion": "51.2-1",
      "fix": "DEBIAN-CVE-2026-118598",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-118598",
      "released": "2026-11-04T19:14:43Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}