CVE-2026-18487

{
  "id": "CVE-2026-18487",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:16:50.250",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:[email protected]/](https://trusted.com:[email protected]/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site."
    },
    {
      "lang": "es",
      "value": "Se encontró un fallo en Epiphany. Un problema en cómo el navegador lee las direcciones web permite a los atacantes falsificar el nombre de dominio mostrado en la barra de direcciones. Si un usuario hace clic en un enlace especialmente diseñado que contiene dos puntos (por ejemplo, [https://trusted.com:[email protected]/](https://trusted.com:[email protected]/)), la barra de direcciones y los menús de seguridad mostrarán el sitio web seguro (trusted.com) pero en realidad cargará el sitio web del atacante (attacker.com) en la pantalla. Esto permite a los atacantes crear páginas de phishing convincentes para engañar a los usuarios para que confíen en un sitio malicioso."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GNOME",
          "product": "Epiphany",
          "defaultStatus": "unaffected",
          "collectionURL": "https://gitlab.gnome.org/GNOME/epiphany",
          "packageName": "epiphany",
          "versions": [
            {
              "version": "49.2",
              "lessThan": "*",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T15:37:47.946112Z",
          "id": "CVE-2026-18487",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-451"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-18487",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509570",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/commit/0dde1d369458ac5c44b74b5ad3c433f825f6f8af",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897",
      "source": "[email protected]"
    }
  ]
}