Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Epiphany's form autofill feature. When a user triggers autofill from the context menu, the browser process built JavaScript by interpolating a CSS selector derived from untrusted page content (element id attributes) into a script string without escaping. A malicious website can set a crafted id on a form field to break out of the string context and execute arbitrary JavaScript in Epiphany's privileged autofill script world, which exposes the EphyAutofill credential API and password manager handlers. Reporter demonstrated credential injection across origins and permission enumeration. Fixed upstream in epiphany 50.6 and 49.9 (MR !2147).