CVE-2025-3839: Epiphany Browser RCE Vulnerability

CVE-2025-3839 Overview

CVE-2025-3839 is a trust boundary violation [CWE-356] in Epiphany, the GNOME web browser. The flaw allows websites to invoke external URL handler applications with minimal user interaction. Epiphany does not properly warn users or gate the action before dispatching the URL to a registered handler. Attackers can leverage this behavior to reach vulnerabilities inside those external handlers, effectively turning local handler bugs into remotely reachable code execution paths. The issue stems from trusted UI behavior masking a dangerous cross-application invocation.

Critical Impact
Remote attackers can trigger external URL handler applications from a malicious web page, enabling code execution on the client device through chained handler vulnerabilities without adequate user consent prompts.

Affected Products

Epiphany (GNOME Web) browser
Red Hat Enterprise Linux distributions shipping Epiphany
Downstream Linux distributions packaging the affected Epiphany releases

Discovery Timeline

2026-01-23 - CVE-2025-3839 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3839

Vulnerability Analysis

The vulnerability resides in how Epiphany handles external URL schemes registered to non-browser applications. When a web page references a URL whose scheme maps to an external handler, Epiphany dispatches the URL with insufficient user gating. The browser treats the action as a routine navigation rather than a cross-application invocation that delivers attacker-controlled input to another binary.

This design choice violates the trust boundary between untrusted web content and locally installed software [CWE-356]. Handler applications generally assume URLs originate from user intent. Epiphany breaks that assumption by routing arbitrary web-sourced URLs into handlers without prominent confirmation. Any parsing flaw, command injection sink, or argument-handling bug in a registered handler becomes reachable from a malicious page.

Exploitation requires user interaction such as visiting a crafted page or clicking a link. The attack complexity is elevated because the adversary must identify an exploitable handler installed on the target. A successful chain affects confidentiality and integrity on the client device while crossing a security scope boundary from the browser sandbox to the external application.

Root Cause

The root cause is a privilege and trust separation failure. Epiphany dispatches external scheme invocations from web content without enforcing an explicit, scheme-specific consent prompt. The UI presents the action as a normal navigation, so users cannot reliably distinguish a hyperlink from a cross-application command.

Attack Vector

An attacker hosts a page referencing an external URL scheme such as a custom handler registered by a desktop application. When a user follows the link or the page triggers navigation, Epiphany invokes the handler with the attacker-supplied URL. If the handler mishandles its input, the attacker achieves code execution in the handler's process context.

No functional exploitation code is available in the referenced advisories. Technical details on the dispatch path and affected handlers are documented in the Red Hat CVE-2025-3839 Advisory and the Red Hat Bug Report #2361430.

Detection Methods for CVE-2025-3839

Indicators of Compromise

Epiphany process spawning child processes that correspond to registered URL handler applications shortly after a web navigation event
Unexpected command-line arguments passed to desktop applications containing URL-encoded payloads or shell metacharacters
xdg-open or gio open invocations originating from the Epiphany process tree with attacker-controlled URI inputs

Detection Strategies

Monitor process lineage on Linux endpoints for epiphany parent processes launching non-browser binaries through D-Bus or xdg-open
Inspect HTTP and HTML telemetry for pages referencing uncommon URI schemes or <iframe> elements pointing to custom handler protocols
Correlate browser navigation logs with execve telemetry to identify cross-application invocations triggered by web content

Monitoring Recommendations

Enable auditd or eBPF-based process execution logging on workstations running Epiphany
Forward browser and process telemetry to a centralized analytics platform for retroactive hunting against newly disclosed handler bugs
Alert on Epiphany invoking handlers that historically have not been triggered by that user, indicating anomalous scheme dispatch

How to Mitigate CVE-2025-3839

Immediate Actions Required

Apply vendor updates for Epiphany once distribution maintainers publish patched packages tracked in the Red Hat CVE-2025-3839 Advisory
Inventory installed URL handlers on endpoints running Epiphany and remove or update handlers with known parsing or argument-handling flaws
Restrict use of Epiphany for browsing untrusted content until the patched build is deployed

Patch Information

No fixed version is enumerated in the published NVD record at the time of writing. Track the Red Hat CVE-2025-3839 Advisory and the upstream GNOME Web release notes for patched package versions. Distribution vendors will release updated Epiphany packages that introduce explicit user consent prompts before dispatching external URL handlers.

Workarounds

Unregister or disable non-essential URL scheme handlers using xdg-mime to reduce the reachable handler surface
Configure GNOME desktop policy to require explicit confirmation before launching external applications from web content
Steer users to a hardened browser for general browsing until Epiphany is updated

bash

# List the default handler registered for a given URI scheme
xdg-mime query default x-scheme-handler/<scheme>

# Remove a non-essential handler association to shrink attack surface
xdg-mime default /dev/null x-scheme-handler/<scheme>