Bug 2537342 (CVE-2026-94291)

Summary: CVE-2026-94291 epiphany: Insecure iframe framing via ephy-reader/view-source schemes allows local file exfiltration
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Epiphany (GNOME Web). The ephy-reader and view-source URI schemes are not registered as display-isolated, allowing a remote attacker to frame them from web content via iframes. This can be exploited to exfiltrate local files when a user visits a malicious website.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2537343    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-21 09:37:13 UTC 
Epiphany (GNOME Web) registers custom URI schemes (ephy-reader, view-source, ephy-webextension) without marking them as display-isolated. This allows a malicious web page to embed these schemes in iframes from an HTTP context, bypassing WebKit's normal framing security controls.

Because the ephy-reader and view-source schemes can access local content, an attacker-controlled web page can use this to exfiltrate local files from the user's system. Exploitation requires the user to visit a malicious website.

The fix (commit 25e1828903cb2419e18c437723b0f87fb5d31780) registers these schemes as display-isolated via webkit_security_manager_register_uri_scheme_as_display_isolated(), preventing web content from framing them.

Upstream issue: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2952
Upstream fix: https://gitlab.gnome.org/GNOME/epiphany/-/commit/25e1828903cb2419e18c437723b0f87fb5d31780
Comment 2 Mauro Matteo Cascella 2026-09-21 09:40:03 UTC 
Upstream issue:
https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2952

Upstream fix:
https://gitlab.gnome.org/GNOME/epiphany/-/commit/25e1828903cb2419e18c437723b0f87fb5d31780