CVE-2025-3839
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:NSummary
CVE-2025-3839 is a high-severity Product UI does not Warn User of Unsafe Actions (CWE-356) vulnerability. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique User Execution (T1204); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-3839 is a vulnerability in Epiphany, a web browser that enables websites to launch external URL handler applications with minimal user interaction and without adequate warnings or gating. This design flaw, classified under CWE-356, allows attackers to exploit vulnerabilities in those handlers by leveraging the browser's trusted UI behavior, potentially resulting in code execution on the client device. The vulnerability carries a CVSS v3.1 base score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) and was published on 2026-01-23.
Remote attackers require no privileges to target victims over the network, but exploitation demands high complexity and user interaction, such as clicking a malicious link. Success changes the attack scope and achieves high impacts on confidentiality and integrity, enabling code execution through the invoked external handlers that appear as legitimate browser actions.
Red Hat advisories detail mitigations and patches for this issue, available at https://access.redhat.com/security/cve/CVE-2025-3839, with further technical discussion in the Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2361430.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4436
Vulnerability Data
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails…
more
to properly warn or gate this action, resulting in potential code execution on the client device via trusted UI behavior.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates explicit user-visible indication, directly countering absence of warnings for device activation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices include UI design requirements that warn users before unsafe actions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can verify presence of warnings for unsafe user actions.
Security awareness training can teach users to heed or demand warnings for unsafe actions.
Secure development life cycle requires UI design to warn users before unsafe actions.
Application security requirements include user warnings for dangerous operations.
Secure architecture principles can mandate confirmation prompts for risky actions.
Secure coding practices can embed user warnings before unsafe operations.