Skip to content
Fencer Vulns
high 8.0

CVE-2025-3839 json

Epiphany: insecure external protocol invocation in epiphany

published 2026-01-23 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-4436

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this action, resulting in potential code execution on the client device via trusted UI behavior.

Patch / fix

  • epiphany-browser Debian 14, Debian 13 48.1-1

debian advisories DEBIAN-CVE-2025-3839

  • epiphany openSUSE Tumbleweed 48.1-1.1

opensuse advisories openSUSE-SU-2025:15011-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-3839 updated cvss 8.0

epiphany: Insecure External Protocol Invocation in Epiphany

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
9 mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Classification

Weakness
  • CWE-356 Missing User Interaction for Potentially Unsafe Action

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.