epiphany-51.0

[Bruce Dubbs]

New major version.

This appears to be the first package for gnome-51.

[Bruce Dubbs]

51.0 - September 10, 2026

• Bugs fixed:
  • session: Append closed tab at end if recorded position is out of bounds
  • (CVE-2026-18487) Address Bar / Host Spoofing via userinfo in ephy_uri_get_decoded_host
  • Code Injection via ephy_web_view_get_best_web_app_icon in data: URI
  • data URI prettification returns invalid domain (Michael Catanzaro)
  • Some fixes for EphyHistoryDialogRow

• Translation updates

51.rc - August 27, 2026

• Bugs fixed:
  • Invalid bookmark import crashes browser
  • XSS/HTML injection in error page
  • (CVE-2026-77682) Autofill JS Code Injection via CSS Selector
  • (CVE-2026-77679) WebExtension XPI Path Traversal ZIPSLIP
  • Link clicked in another app opens in the fullscreen window during fullscreen video
  • Caret in the address bar jumps to the start when I switch keyboard layout
  • "Not Secure" label in the address bar is truncated and glued to the domain in translated locales
  • Epiphany offers to save a password that it just autofilled itself (after CSV import)
  • Update to highlight.js 11.2.0
  • web-process-extension: Target active frame when generating password from context menu
  • Canary: Fix WebKitGTK injected bundle path
  • Do not trigger downloads on missing MIME type or failed HTTP responses

• Translation updates

51.beta - August 10, 2026

• Bugs fixed:
  • Colons in URL for Epiphany's app mode are converted to "A"
  • Compile failures against libnettle 4.0
  • Memory leak in the core string utility function ephy_string_shorten()
  • Out-of-bounds crash/assert failure in ephy_json_array_get_string_with_default
  • Invalid view-source: crashes browser
  • CI: Add gobject-linter
  • add pinning support for URLs in history and overview model
  • window: update message when saving a password
  • Remove incorrect use of G_GNUC_CONST for get_type() functions
  • Update highlight.js to 11.11.2
  • Add libpwquality to Canary manifest
  • history-service: use G_SOURCE_REMOVE
  • fix: check for invalid icon
  • Fix code style check
  • Adjust Reader Mode Line Spacing
  • view-source-handler: fix crash when loading invalid URI
  • Fix CI failures
  • Canary: Disable WebRTC for now
  • Reland property registration code style changes
  • ci: move check-potfiles to lint stage
  • ci: ignore blueprint-compiler failures during style check
  • Canary: Re-enable WebRTC

51.alpha - June 25, 2026

• Bugs fixed:
  • Crash when opening preferences dialog after deleting default search engine
  • [Feature Request] Keyboard shortcut to copy the current page URL
  • Search engine suggestions in addressbar autocompletion dropdown are visually overloading due to their URLs being shown
  • Addressbar URL prettification does not understand IPv6 addresses
  • Editing password username creates duplicate entries
  • webextension: Replace EphyWebExtension with WebKitWebExtension
  • Firefox sync OAuth token flow
  • Use libportal API to detect sandbox
  • window-commands: improve notification when failing to install
  • Change default adblock filters back to bnema
  • window: Set devel CSS also for Canary builds
  • canary: Disable Vulkan support
  • site-menu-button: add rudimentary debug logging
  • password-manager: fix crash when deleting password record
  • Quote command line input before passing to shell
  • password-manager: avoid duplicate record when changing username
  • Fix crash when opening preferences dialog after deleting a search engine (Michael Catanzaro)
  • bookmark-props: Save bookmark on Ctrl + Enter
  • bookmark-props: Select tag when row is clicked on
  • web-view: fix memory corruption caused by previous memory corruption fix
  • docs: clarify HiDPI snapshot sizing requirements and refactor about.css for readability
  • Fix crash after adding a new OpenSearch engine
  • feat: add undo functionality to overview item removal via toast notifications
  • site-menu-button: remove unused function
  • shortcuts: document F6 shortcut
  • Allow user to generate secure passwords with libpwquality

[Bruce Dubbs]

Updated at commit 2141cccea0. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-027 has been issued.