Description

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon (for example, [https://trusted.com:80@attacker.com/](https://trusted.com:80@attacker.com/)), the address bar and security menus will display the safe website (trusted.com) but it will actually load the attacker website (attacker.com) on the screen. This allows attackers to create convincing phishing pages to trick users into trusting a malicious site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-06T22:16:50.250Z",
  "pubdate": "2026-08-06T22:16:50.250Z",
  "executiveSummary": "A URL parsing flaw has been identified in Epiphany, which introduces an address bar spoofing vulnerability.\nThe vulnerability allows remote attackers to deceive users regarding the authenticity of the currently loaded web page by falsifying the domain name rendered within the browser's address bar and security menus.\nThe root cause stems from improper handling of authority components containing colons within Uniform Resource Identifiers, specifically when parsing credentials and port numbers in the context of Hypertext Transfer Protocol Secure URLs.\nThe impact of this security deficiency is severe in the context of social engineering, as it facilitates high-fidelity phishing campaigns.\nAn attacker can construct a maliciously crafted link incorporating structural anomalies, such as https://trusted.com:80@attacker.com/, which misleads the browser's user interface rendering engine.\nWhile the browser navigates to and loads content originating from attacker.com, the visual indicators persistently display trusted.com, effectively subverting critical browser trust boundaries.\nExploitation requires user interaction, specifically the victim clicking the maliciously crafted link.\nNo authentication or elevated privileges are required by the attacker prior to exploitation, and the attack vector is network-based.\nRisk implications include credential harvesting, unauthorized session token acquisition, and the potential delivery of secondary payloads under the guise of an authentic, trusted entity.",
  "technicalDetails": "The vulnerability resides within the URL parsing and rendering components of the Epiphany web browser, specifically in how the application processes authority sections containing embedded characters such as colons and commercial at-signs (@).\nAccording to URI syntax specifications, the authority component may include user information followed by an optional port number preceding the host identifier. The flaw is triggered when the browser's parsing engine misinterprets the hierarchical precedence of these delimiters.\nWhen processing a specifically engineered payload such as https://trusted.com:80@attacker.com/, the component parser incorrectly identifies trusted.com as part of the user information or port context due to the presence of the colon, while the actual network socket connection is established with attacker.com.\nThe attack flow proceeds as follows: First, the attacker crafts a hyperlink embedding the deceptive Uniform Resource Identifier structure and distributes it to the target user via phishing vectors such as email, malicious advertisements, or compromised web pages.\nSecond, the user interacts with the link by clicking it within the Epiphany browser interface.\nThird, the browser initiates a network request. Due to the parsing anomaly, the underlying network stack resolves the destination host as attacker.com and successfully loads the malicious content over the specified protocol.\nFourth, during and after the navigation event, the browser user interface executes its routine display logic, extracting the perceived hostname for rendering in the address bar and security indicator menus.\nBecause of the parsing discrepancy, the user interface extracts trusted.com from the malformed authority string rather than the actual socket destination, resulting in a desynchronization between the network origin and the visual representation.\nNetwork exposure is fully external, as the vulnerability is triggered via standard web browsing mechanisms over HTTP or HTTPS protocols.\nNo pre-existing authentication or local system privileges are required to mount this attack, making it accessible to unauthenticated remote threat actors.\nThe post-exploitation impact includes the successful execution of targeted phishing attacks, wherein users interact with malicious domains under the false assumption that they are communicating with a verified, trusted service, thereby exposing sensitive data such as passwords, multi-factor authentication tokens, and personally identifiable information."
}