Every CVE Search/ Get API key

CVE-2021-45086

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's...

6.1 MediumFix available

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.39%Up 0.7 points since Dec 16, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
CVE-2021-45086
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
CVE-2021-45086
Updated
2026-11-02
EUVDEUVD-2021-31877 No score

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
EUVD-2021-31877
Updated
2026-11-03
GitHub AdvisoriesGHSA-vv96-jq6f-v366 No score

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's...

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
GHSA-vv96-jq6f-v366
Weakness
CWE-79
Updated
2026-11-02
OSVALPINE-CVE-2021-45086 6.1

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
ALPINE-CVE-2021-45086
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSV 6.1

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
CVE-2021-45086
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-45086 6.1

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
DEBIAN-CVE-2021-45086
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2022-1627 7.5

epiphany security update

Epiphany is the web browser for the GNOME desktop. Its goal is to be simple and easy to use. Epiphany ties together many GNOME components in order to let you focus on the Web content, instead of the browser application.

Security Fix(es):

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list.(CVE-2021-45085)

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server s suggested_filename is used as the pdf_name value in PDF.js.(CVE-2021-45086)

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title.(CVE-2021-45087)

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.(CVE-2021-45088)

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title. The issue occurs because the number of bytes for a UTF-8 ellipsis character is not properly considered.(CVE-2022-29536)

Record
OESA-2022-1627
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-45086 6.1

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Record
UBUNTU-CVE-2021-45086
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVMGASA-2022-0053 No score

Updated epiphany packages fix security vulnerability

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list (CVE-2021-45085).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js (CVE-2021-45086).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a page title (CVE-2021-45087).

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page (CVE-2021-45088).

Record
MGASA-2022-0053
Updated
2026-11-02
OSVUSN-5561-1 No score

epiphany-browser vulnerabilities

It was discovered that GNOME Web incorrectly filtered certain strings. A remote attacker could use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-45085, CVE-2021-45086, CVE-2021-45087)

It was discovered that GNOME Web incorrectly handled certain long page titles. A remote attacker could use this issue to cause GNOME Web to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-29536)

Record
USN-5561-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
epiphany
Alpine:v3.15
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.16
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.17
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.18
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.19
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.20
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.21
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.22
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.23
 41.0 up to 41.3-r0
41.3-r0
epiphany
Alpine:v3.24
 41.0 up to 41.3-r0
41.3-r0
Show 11 moreShow less
Affected packages
PackageAffectedFixed
epiphany-browser
Debian:12
 before 41.2-1
41.2-1
epiphany-browser
Debian:13
 before 41.2-1
41.2-1
epiphany-browser
Debian:14
 before 41.2-1
41.2-1
epiphany-browser
Debian:11
From an advisory covering 4 CVEs
 before 3.38.2-1+deb11u1, plus listed versions
3.38.2-1
3.38.2-1+deb11u1
epiphany
Mageia:8
From an advisory covering 4 CVEs
 before 3.38.2-1.1.mga8
3.38.2-1.1.mga8
epiphany
openEuler:22.03-LTS
From an advisory covering 5 CVEs
 before 40.6-1.oe2203
40.6-1.oe2203
epiphany-browser
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.16.3-1ubuntu13.18.0-1ubuntu23.18.1-1ubuntu13.18.3-0ubuntu13.18.5-0ubuntu13.18.5-0ubuntu1.13.18.10-0ubuntu13.18.11-0ubuntu1
 None known
epiphany-browser
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.26.1-1ubuntu13.26.1-1ubuntu23.26.1-1ubuntu43.26.5.1-1ubuntu13.27.90-1ubuntu1
Show 4 moreShow less
3.28.0.1-1ubuntu13.28.1-1ubuntu13.28.5-0ubuntu13.28.6-0ubuntu1
 None known
epiphany-browser
Ubuntu:20.04:LTS
 before 3.36.4-0ubuntu2, plus listed versions
3.34.1-13.34.1-1build13.36.0-13.36.1-13.36.2-0ubuntu13.36.3-0ubuntu13.36.4-0ubuntu1
3.36.4-0ubuntu2
epiphany-browser
Ubuntu:20.04:LTS
From an advisory covering 4 CVEs
 before 3.36.4-0ubuntu2, plus listed versions
3.34.1-13.34.1-1build13.36.0-13.36.1-13.36.2-0ubuntu13.36.3-0ubuntu13.36.4-0ubuntu1
3.36.4-0ubuntu2
epiphany-browser
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 42.1-1ubuntu1, plus listed versions
41.0-141.0-241.2-141.3-142~beta-142.0-142.1-1
42.1-1ubuntu1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-45086 is a medium vulnerability (CVSS 6.1) in Gnome Epiphany, published December 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in epiphany 41.3-r0.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open