Epiphany has a code injection flaw that allows a malicious web page to craft an element id that terminates the JavaScript string used by the autofill feature. When a user chooses a form autofill action, the browser inserts the unsanitized selector into a single‑quoted string and evaluates it, so the attacker can execute arbitrary JavaScript. The injected code runs in Epiphany’s privileged autofill script world, giving access to credential APIs and potential password enumeration.

The flaw affects the GNOME Project’s Epiphany web browser, specifically all versions from 47.beta onward, until the fix was merged in 50.6 and 49.9. The affected products are Epiphany and its embedded WebKit components used in desktop GTK environments.

The CVSS score of 7.1 denotes a high severity vulnerability. Exploitation requires a user to visit a web page, trigger the context‑menu autofill action, and is thus a user‑interaction scenario. The EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Still, because the injected code executes with privileged access to credential handling APIs, an attacker could read or inject stored passwords and enumerate protected domains, making the risk significant for frequent users of autofill.