A flaw was found in Epiphany's form autofill feature. When a user triggers autofill from the context menu, the browser process built JavaScript by interpolating a CSS selector derived from untrusted page content (element id attributes) into a script string without escaping. A malicious website can set a crafted id on a form field to break out of the string context and execute arbitrary JavaScript in Epiphany's privileged autofill script world, which exposes the EphyAutofill credential API and password manager handlers. Reporter demonstrated credential injection across origins and permission enumeration. Fixed upstream in epiphany 50.6 and 49.9 (MR !2147).