The Epiphany web browser contains a critical design flaw that permits remote websites to trigger external application handlers, creating a pathway for potential code execution on the host system.

This issue is a UI-based security flaw (CWE-356) where the browser fails to properly gate or warn the user before invoking external URL handlers. An unauthenticated remote attacker can exploit this mechanism to interact with vulnerable external handlers, effectively escalating browser-based actions into system-level code execution.

The ability for a remote attacker to execute arbitrary code via the browser poses a severe threat to organizational endpoints. Successful exploitation could lead to full system compromise, data exfiltration, or the installation of persistent malicious software. With a CVSS score of 8.0, this vulnerability represents a high-risk entry point that bypasses traditional browser sandboxing.

Immediate Action: Update the GNOME Epiphany browser to version 47.5, 48.1, or later to implement the necessary security warnings and execution gating.

Proactive Monitoring: Review endpoint process logs for suspicious child processes spawned by the Epiphany browser or unusual external URL handler invocations.

Compensating Controls: While no direct WAF control exists for this client-side issue, organizations may consider disabling unnecessary URL handler registrations on managed workstations to reduce the attack surface.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for remote code execution, this vulnerability should be treated with high priority. Administrators must ensure that all instances of the Epiphany browser are patched to the latest version to prevent exploitation of the insecure URL handler invocation mechanism. Failure to remediate this issue leaves systems susceptible to browser-based attacks that can bypass standard security perimeters.