Opened 12 hours ago

Last modified 10 hours ago

#24206 assigned enhancement

epiphany-51.2 (Security Update)

Reported by: Bruce Dubbs Owned by: Bruce Dubbs
Priority: normal Milestone: 13.2
Component: BOOK Version: git
Severity: normal Keywords:
Cc:

Description

New minor version.

Change History (1)

comment:1 by Bruce Dubbs, 10 hours ago

Summary: epiphany-51.2 → epiphany-51.2 (Security Update)

51.2 - October 29, 2026

  • Bugs fixed:
    • WebApp Epiphany Argument Injection with data URI
    • Crash when restoring first pinned tab
    • Making a tag with an empty name and removing it crashes GNOME Web
    • Unresponsive page dialog reappears even after page became responsive again
    • HTML injection in Epiphany Reader mode
    • (CVE-2026-118598) Allowing a Clipboard or Website-Data-Access prompt grants camera AND microphone access
    • (CVE-2026-115683) TLS/SSL Error Page Bypass window.webkit.messageHandlers.tlsErrorPage
    • Epiphany installs XPI extensions even when the Web Extensions feature is disabled
    • (CVE-2026-118599) XPI extraction allows hard-link targets - TAR .xpi overwrites an existing user file
    • Epiphany loads installed WebExtensions when the feature is disabled
    • Do not focus location entry when opening web URIs
    • reader: Escape reading time before inserting it into the page
  • Translation updates
Last edited 10 hours ago by Bruce Dubbs (previous) (diff)
Note: See TracTickets for help on using tickets.