A race condition in the Epiphany web browser allows a malicious web page to bypass the TLS/SSL certificate warning dialog by exploiting a timing window when the message handler for the error page is still unregistered. During this brief period an attacker can call the unprotected WebKit message handler and, by guessing the predictable page identifier, confirm an invalid certificate with no user interaction, leading to potential man‑in‑the‑middle attacks or site spoofing.

All current releases of the Epiphany browser distributed by GNOME are vulnerable. The issue spans both pre‑45.x and post‑45.x versions, as the race condition existed since commit 1da1caed. Any installation that registers the 'tlsErrorPage' handler immediately before loading the error page is subject to this flaw.

The flaw carries a CVSS score of 6.8, indicating moderate severity, and the EPSS score is not available; it is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability by hosting a malicious site that redirects to a target with an invalid certificate, taking advantage of the race condition for a few milliseconds before the application restarts. Successful exploitation allows the attacker to add a certificate exception without user confirmation, thereby enabling man‑in‑the‑middle or spoofing attacks.