DEBIAN-CVE-2026-18487

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-18487
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18487.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-18487
Upstream
Published
2026-08-06T22:16:50Z
Modified
2026-09-14T17:02:50Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, https://trusted.com:80@attacker.com/), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

References

Affected packages

Debian:12 / epiphany-browser

Package

Name
epiphany-browser
Purl
pkg:deb/debian/epiphany-browser?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

43.*
43.1-1
Other
44~rc-1
45~beta-1
46~alpha-1
46~beta-1
47~beta-1
47~rc-1
48~beta-1
48~rc-1
48~rc-2
51~rc-1
44.*
44.0-1
44.1-1
44.2-1
44.3-1
44.5-1
44.5-2
44.6-1
45.*
45.0-1
45.1-1
45.2-1
46.*
46.0-1
46.0-2
46.1-1
46.2-1
46.3-1
47.*
47.0-1
47.2-1
48.*
48.0-1
48.1-1
48.2-1
48.3-1
48.3-2
48.5-1
48.5-2
48.5-3
49.*
49.0-1
49.1-1
49.2-1
49.2-2
49.2-3
50.*
50.3-1
50.3-2
50.4-1
50.4-2
51.*
51.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18487.json"

Debian:13 / epiphany-browser

Package

Name
epiphany-browser
Purl
pkg:deb/debian/epiphany-browser?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

48.*
48.3-2
48.5-0+deb13u1
48.5-1
48.5-2
48.5-3
49.*
49.0-1
49.1-1
49.2-1
49.2-2
49.2-3
50.*
50.3-1
50.3-2
50.4-1
50.4-2
Other
51~rc-1
51.*
51.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18487.json"

Debian:14 / epiphany-browser

Package

Name
epiphany-browser
Purl
pkg:deb/debian/epiphany-browser?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
51~rc-1

Affected versions

48.*
48.3-2
48.5-1
48.5-2
48.5-3
49.*
49.0-1
49.1-1
49.2-1
49.2-2
49.2-3
50.*
50.3-1
50.3-2
50.4-1
50.4-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18487.json"