CVE-2026-18487

Name	CVE-2026-18487
Description	A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1143966

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
epiphany-browser (PTS)	bullseye (security), bullseye	3.38.2-1+deb11u3	vulnerable
	bookworm	43.1-1	vulnerable
	trixie	48.5-0+deb13u1	vulnerable
	forky, sid	50.4-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
epiphany-browser	source	(unstable)	(unfixed)			1143966

Notes

[trixie] - epiphany-browser <no-dsa> (Minor issue)
https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2897
https://gitlab.gnome.org/GNOME/epiphany/-/commit/13dd600719d7aac532ed6c84ea0d12dd372d4ac4