Epiphany has a flaw in URI parsing that allows an attacker to craft a link containing a colon and userinfo segment to make the browser display a benign domain in the address bar while actually loading a malicious site. For example, a URL like https://trusted.com:80@attacker.com/ will cause the browser to show trusted.com as the active domain and the security menus to reflect that, but the content displayed is from attacker.com. This can mislead users into trusting a phishing page that looks legitimate. The weakness is identified as CWE-451, Information Exposure, because the displayed information does not match the actual target.

The vulnerable product is GNOME:Epiphany. Specific affected versions are not listed in the provided data, so users of any Epiphany deployment should verify whether they are running a version prior to the patch committed in the referenced GitLab commit.

The CVSS score of 5.4 rates the issue as moderate; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Likely attackers can exploit this by delivering crafted links via email, instant messaging, or web pages. A victim clicking the link will be shown a trusted domain while the attacker gains deceptive access to the user’s browsing context.