Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115683— epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler

Quick assessment

Affected
GNOME Epiphany
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Epiphany 浏览器中存在一个竞态条件漏洞，允许恶意网站绕过 TLS/SSL 证书警告页面。 Epiphany 注册了名为 "tlsErrorPage" 的主世界脚本消息处理器，以便其内部 TLS 错误页面能够实现“接受风险并继续”功能。该处理器在加载错误页面之前立即注册，导致在短暂的时间窗口内，先前加载的不受信任源仍可通过 调用该处理器。唯一的授权检查仅比较一个可预测递增的数值型 WebKit 页面 ID；攻击者可通过快速猜测 ID 来批准证书例外，而无需用户点击。 如果受害者访问恶意网站 A，而该网站将用户

CVSS 6.8 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
GNOME Epiphany < * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115683

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
Source: CVE Program / CVE List V5
Vulnerability Description
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GNOME Epiphany 0 ~ * -

II. Public POCs for CVE-2026-115683

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115683

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-115683 (1)

Vendor Advisories for CVE-2026-115683 (1)

Proof of Concept for CVE-2026-115683 (1)

Other References for CVE-2026-115683 (1)

IV. Related Vulnerabilities

Same product: Epiphany
Same vendor: GNOME
Same weakness: CWE-367