Description
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.

Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click.

If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host.

Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
Proof of concept: https://beford.net/poc/ssl_poc.html
Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.
Published: 2026-10-30
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: TLS certificate bypass enabling man‑in‑the‑middle
Action: Patch
AI Analysis

Impact

A race condition in the Epiphany web browser allows a malicious web page to bypass the TLS/SSL certificate warning dialog by exploiting a timing window when the message handler for the error page is still unregistered. During this brief period an attacker can call the unprotected WebKit message handler and, by guessing the predictable page identifier, confirm an invalid certificate with no user interaction, leading to potential man‑in‑the‑middle attacks or site spoofing.

Affected Systems

All current releases of the Epiphany browser distributed by GNOME are vulnerable. The issue spans both pre‑45.x and post‑45.x versions, as the race condition existed since commit 1da1caed. Any installation that registers the 'tlsErrorPage' handler immediately before loading the error page is subject to this flaw.

Risk and Exploitability

The flaw carries a CVSS score of 6.8, indicating moderate severity, and the EPSS score is not available; it is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability by hosting a malicious site that redirects to a target with an invalid certificate, taking advantage of the race condition for a few milliseconds before the application restarts. Successful exploitation allows the attacker to add a certificate exception without user confirmation, thereby enabling man‑in‑the‑middle or spoofing attacks.

Generated by OpenCVE AI on October 30, 2026 at 14:37 UTC.

Remediation

Vendor Workaround

Until a fixed Epiphany build is installed, avoid following links from untrusted sites to HTTPS destinations, and do not rely on Epiphany for sensitive sites when browsing untrusted content. Restrict network access for untrusted browsing where practical (https://cmetaxonomy.org/entries/CME-203.html). Restarting the browser clears any attacker-installed certificate exceptions for the session.

OpenCVE Recommended Actions

  • Apply the pending Epiphany patch from merge request 2245 that registers TLS error page handlers only after the LOAD_COMMITTED event is fired.
  • Once patched, restart Epiphany to clear any previously cached error‑page handlers and ensure the updated code is in use.
  • Until a fixed Epiphany build is installed, avoid following links from untrusted sites to HTTPS destinations and do not rely on Epiphany for sensitive sites when browsing untrusted content.
  • Restrict network access for untrusted browsing where practical.
  • Restart the browser clears any attacker-installed certificate exceptions for the session.

Generated by OpenCVE AI on October 30, 2026 at 14:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content. A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.
Title epiphany: epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
References

Sat, 24 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Gnome
Gnome epiphany
Vendors & Products Gnome
Gnome epiphany

Sat, 24 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Description A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click. If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host. Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978 Proof of concept: https://beford.net/poc/ssl_poc.html Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.
Title epiphany: epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
Weaknesses CWE-367
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}

threat_severity

Moderate

Subscriptions

Gnome Epiphany
cve-icon MITRE

Status: PUBLISHED

Assigner: fedora

Published:

Updated: 2026-11-02T11:33:33.900Z

Reserved: 2026-10-23T08:58:10.076Z

Link: CVE-2026-115683

cve-icon Vulnrichment

Updated: 2026-10-30T14:07:59.972Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-30T14:16:39.373

Modified: 2026-11-02T10:17:10.910

Link: CVE-2026-115683

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-21T00:00:00Z

Links: CVE-2026-115683 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T14:45:14Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition