CVE-2026-18487

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18487
Downstream
Published
2026-08-06T16:32:39.361Z
Modified
2026-08-09T08:32:48.268088Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()
Details

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:80@attacker.com/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Database specific 
{
    "cwe_ids": [
        "CWE-451"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18487.json",
    "cna_assigner": "fedora",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "49.2"
                },
                {
                    "fixed": "*"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / gitlab.gnome.org/gnome/epiphany

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/epiphany
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0dde1d369458ac5c44b74b5ad3c433f825f6f8af
Database specific
Show details 
{
    "source": "REFERENCES"
}

Database specific

vanir_signatures_modified 
"2026-08-09T08:32:48Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-18487-08293429",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79555952730429607874574242843644172216",
                "276567282846055803300586341278100624348",
                "281874074906607805168207755602729968511",
                "110796903567698710691047652289049046439",
                "196041396835938513119080125895880063818",
                "132244288052758448378874852792557774665"
            ]
        },
        "source": "https://gitlab.gnome.org/gnome/epiphany@0dde1d369458ac5c44b74b5ad3c433f825f6f8af",
        "target": {
            "file": "lib/ephy-uri-helpers.c"
        }
    },
    {
        "id": "CVE-2026-18487-22c24d93",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 209.0,
            "function_hash": "326547117367726038509835447223129739694"
        },
        "source": "https://gitlab.gnome.org/gnome/epiphany@0dde1d369458ac5c44b74b5ad3c433f825f6f8af",
        "target": {
            "function": "main",
            "file": "tests/ephy-uri-helpers-test.c"
        }
    },
    {
        "id": "CVE-2026-18487-7638b420",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 223.0,
            "function_hash": "103625730062097178287298699366776427836"
        },
        "source": "https://gitlab.gnome.org/gnome/epiphany@0dde1d369458ac5c44b74b5ad3c433f825f6f8af",
        "target": {
            "function": "get_first_colon_after_host",
            "file": "lib/ephy-uri-helpers.c"
        }
    },
    {
        "id": "CVE-2026-18487-bf152641",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "316761273235217410531832696863583443486",
                "199024663246324012920505026150450555929",
                "126285416847618225884770633167507205451",
                "29253150288252326953053697937766801220",
                "172842192521130602345407906364989210081",
                "308528678961315984665268235977663741218",
                "106139058338045003775270537045924972671",
                "17407003303251449032020644969937761808",
                "106458710483105673704916105619557822689",
                "117343801148315150306482281077447683990",
                "4511274906747737404169112252616882513"
            ]
        },
        "source": "https://gitlab.gnome.org/gnome/epiphany@0dde1d369458ac5c44b74b5ad3c433f825f6f8af",
        "target": {
            "file": "tests/ephy-uri-helpers-test.c"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18487.json"