CVE-2023-26081 – This vulnerability in Epiphany (GNOME Web brows... (How to Fix)

Q: What is the severity of CVE-2023-26081?

CVE-2023-26081 has a CVSS score of 7.5 (HIGH). This vulnerability in Epiphany (GNOME Web browser) allows malicious websites to trick users into exfiltrating saved passwords. The browser's autofill feature incorrectly operates in sandboxed contexts, enabling attackers to capture credentials. Users of Epiphany browser versions through 43.0 are affected.

📋 TL;DR

This vulnerability in Epiphany (GNOME Web browser) allows malicious websites to trick users into exfiltrating saved passwords. The browser's autofill feature incorrectly operates in sandboxed contexts, enabling attackers to capture credentials. Users of Epiphany browser versions through 43.0 are affected.

💻 Affected Systems

Products:

Epiphany (GNOME Web)

Versions: through 43.0

Operating Systems: Linux distributions with GNOME (Debian, Fedora, Ubuntu, etc.)

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects Epiphany browser with autofill enabled (default). Other browsers are not affected.

📦 What is this software?

Epiphany by Gnome

View all CVEs affecting Epiphany →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers steal saved passwords for websites, email accounts, and other credentials stored in the browser, leading to account compromise and potential identity theft.

🟠

Likely Case

Users visiting malicious websites could have their saved credentials for other sites captured without their knowledge, enabling credential theft.

🟢

If Mitigated

With proper patching, the autofill feature is restricted from operating in sandboxed contexts, preventing credential exfiltration.

🌐 Internet-Facing: HIGH

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires user interaction (visiting malicious website) but no authentication. Proof of concept is publicly available in security advisory.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 43.0

Vendor Advisory: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1275

Restart Required: Yes

Instructions:

1. Update Epiphany browser through your distribution's package manager. 2. For Debian: apt update && apt upgrade epiphany-browser. 3. For Fedora: dnf update epiphany. 4. Restart the browser after update.

🔧 Temporary Workarounds

Disable Autofill

linux

Temporarily disable password autofill feature in Epiphany settings

Use Alternative Browser

all

Switch to a different web browser until Epiphany is patched

🧯 If You Can't Patch

Disable password autofill in Epiphany browser settings immediately
Avoid using Epiphany for accessing sensitive websites or services until patched

🔍 How to Verify

Check if Vulnerable:

Check Epiphany version: epiphany --version. If version is 43.0 or earlier, you are vulnerable.

Check Version:

epiphany --version

Verify Fix Applied:

After update, verify version is greater than 43.0: epiphany --version

📡 Detection & Monitoring

Log Indicators:

Unusual autofill events in browser logs
Multiple failed authentication attempts from user accounts

Network Indicators:

Unexpected outbound connections from browser to unknown domains during website visits

SIEM Query:

source="browser_logs" AND event="autofill" AND context="sandboxed"

📊 Metadata

CVE ID: CVE-2023-26081

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-668

Published: February 20, 2023

Last Updated: March 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-26081, you might also want to check these: