Bug 2537348 (CVE-2026-94292)

Summary:	CVE-2026-94292 epiphany: Insecure autofill visibility check allows silent exfiltration of sensitive data via CSS-hidden form fields
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Epiphany (GNOME Web). The autofill visibility check only tests an element's on-screen size and fails to detect form fields hidden via CSS properties such as display:none, visibility:hidden, or opacity:0. A malicious web page can include hidden form fields that are silently populated with sensitive data, including credit card numbers, when the user triggers autofill.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2537349
Bug Blocks:

Description OSIDB Bzimport 2026-09-21 09:52:20 UTC

A flaw was found in Epiphany's form autofill feature. The EphyAutofill.isVisible() function only checks an element's on-screen size and does not detect fields hidden via CSS properties such as display:none, visibility:hidden, or opacity:0. A malicious web page can include hidden form fields that are silently populated with sensitive data (personal information, credit card numbers) when the user triggers autofill. The hidden field values can then be exfiltrated via JavaScript.

This is particularly impactful in Epiphany because credit card information is autofilled directly without requiring CVV confirmation, unlike other browsers.

Upstream issue: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2951

Comment 1 Mauro Matteo Cascella 2026-09-21 09:53:39 UTC

Upstream issue:
https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2951