Bug 2537342 (CVE-2026-94291) - CVE-2026-94291 epiphany: Insecure iframe framing via ephy-reader/view-source schemes allows local file exfiltration
Summary: CVE-2026-94291 epiphany: Insecure iframe framing via ephy-reader/view-source ...
Keywords:
Status: NEW
Alias: CVE-2026-94291
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2537343
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-21 09:37 UTC by OSIDB Bzimport
Modified: 2026-09-21 09:43 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-21 09:37:13 UTC 
Epiphany (GNOME Web) registers custom URI schemes (ephy-reader, view-source, ephy-webextension) without marking them as display-isolated. This allows a malicious web page to embed these schemes in iframes from an HTTP context, bypassing WebKit's normal framing security controls.

Because the ephy-reader and view-source schemes can access local content, an attacker-controlled web page can use this to exfiltrate local files from the user's system. Exploitation requires the user to visit a malicious website.

The fix (commit 25e1828903cb2419e18c437723b0f87fb5d31780) registers these schemes as display-isolated via webkit_security_manager_register_uri_scheme_as_display_isolated(), preventing web content from framing them.

Upstream issue: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2952
Upstream fix: https://gitlab.gnome.org/GNOME/epiphany/-/commit/25e1828903cb2419e18c437723b0f87fb5d31780
Comment 2 Mauro Matteo Cascella 2026-09-21 09:40:03 UTC 
Upstream issue:
https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2952

Upstream fix:
https://gitlab.gnome.org/GNOME/epiphany/-/commit/25e1828903cb2419e18c437723b0f87fb5d31780
Note You need to log in before you can comment on or make changes to this bug.