CVE-2023-26081

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-668

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Feb 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-260833.3Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver aCVE-2023-260843.7The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected dataCVE-2023-260857.8A possible out-of-bounds read and write (due to an improper length check of shared memory) was discovered in Arm NN Android-NN-Driver beforeCVE-2023-260887.8In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine systemCVE-2023-260899.8European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. ThCVE-2023-26095.5NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.CVE-2023-260916.1The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.CVE-2023-260929.8Liima before 1.17.28 allows server-side template injection.CVE-2023-260939.8Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter.CVE-2023-260957.5ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet.CVE-2023-260975.5An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blockCVE-2023-260987.8An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arb