CVE-2025-3839 Epiphany: insecure external protocol invocation in epiphany
Epiphany browser allows websites to launch external handlers with minimal warnings, potentially enabling remote code execution via vulnerable handlers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-3839?
CVE-2025-3839 is a high-severity vulnerability in epiphany, published on 23 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this action, resulting in potential code execution on the client device via trusted UI behavior.
Weakness: CWE-356
Which versions are affected by CVE-2025-3839?
Linux distribution packages (1)
epiphany openSUSE:Tumbleweed | All versions | 48.1-1.1 |
How do I fix CVE-2025-3839?
Apply the vendor's patch.
Is CVE-2025-3839 being exploited?
There is no known exploitation of CVE-2025-3839 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-3839, GHSA-h95f-v923-pcr4, UBUNTU-CVE-2025-3839, openSUSE-SU-2025:15011-1.