CVE-2026-18487 in Epiphany
Summary
by MITRE • 08/07/2026
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:[email protected]/](https://trusted.com:[email protected]/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability in the Epiphany web browser represents a sophisticated domain name spoofing flaw that directly undermines user trust and security expectations. The issue stems from how the browser processes Uniform Resource Identifiers containing embedded authentication credentials, specifically when a colon character appears within the URL structure. When users encounter links formatted as https://trusted.com:[email protected]/, the browser displays the legitimate domain name trusted.com in the address bar while actually loading content from the malicious attacker.com domain. This creates a deceptive user experience where visual security indicators misleadingly suggest a safe browsing environment.
The technical exploitation of this vulnerability aligns with CWE-601 and CWE-798 categories, specifically addressing URL redirection and credential exposure issues. The flaw operates at the protocol parsing level where the browser's URI handling mechanism fails to properly validate or sanitize authentication components within URLs, allowing attackers to inject malicious domains while maintaining a deceptive appearance of legitimacy. This vulnerability directly violates the principle of least privilege in web security by permitting unauthorized domain substitution through malformed URL structures.
From an operational impact perspective, this flaw enables sophisticated phishing attacks that can bypass user security awareness training and automated security systems. The deception is particularly effective because it leverages the browser's built-in trust mechanisms, making users believe they are accessing legitimate websites when they are actually interacting with malicious content. Security menus and address bar displays become unreliable indicators of site legitimacy, undermining fundamental security assumptions that users make when browsing the web.
The attack vector demonstrates clear alignment with ATT&CK technique T1566, specifically targeting user trust through deceptive website presentation. Users who might normally recognize phishing attempts through domain name scrutiny can be deceived by this mechanism, as the displayed domain name appears authentic while the underlying content is malicious. This vulnerability particularly affects users who rely on visual security cues during browsing and can be exploited in targeted attacks against specific organizations or individuals.
Effective mitigations for this vulnerability require immediate browser updates that properly validate URL structures and implement stricter URI parsing mechanisms. Security patches should ensure that authentication credentials within URLs do not override or mask the actual domain component, preventing the injection of malicious domains through credential-based URL manipulation. Additionally, browser vendors should consider implementing more robust address bar validation that cross-references displayed domains with actual loaded content to prevent such spoofing scenarios from occurring in user-facing interfaces.