Epiphany: insecure external protocol invocation in epiphany
Priority LOW 37CWE-356Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this action, resulting in potential code execution on the client device via trusted UI behavior.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Fixed epiphany: 47.5, 48.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | epiphany | before 47.5; 48.0 to before 48.1 | 47.5, 48.1 | Patch available | CNA |
- epiphany Vendor— Affected before 47.5; 48.0 to before 48.1 Fixed in 47.5, 48.1 Patch available CNA
Remediation
- Fix · CNA epiphany Fixed in 47.5, 48.1
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-3839
- 2026-10-03 Alias added: GHSA-h95f-v923-pcr4
References
Sources
- CVE-2025-3839 · CVE Program
- CVE-2025-3839 · NVD
- FIRST EPSS
- GHSA-h95f-v923-pcr4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-3839 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences