{"id":"CVE-2026-77682","aliases":["DEBIAN-CVE-2026-77682","UBUNTU-CVE-2026-77682","openSUSE-SU-2026:12361-1","openSUSE-SU-2026:22199-1"],"status":"published","title":"epiphany-51.1-1.1 on GA media","description":"[Use a user message to trigger form autofill]","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-22T14:47:38.497434435Z","modified":"2026-11-01T17:23:30Z","fixes":[{"ecosystem":"Debian:14","package":"epiphany-browser","fixed_in":["51~rc-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["43.1-1","44.0-1","44.1-1","44.2-1","44.3-1","44.5-1","44.5-2","44.6-1","44~rc-1","45.0-1","45.1-1","45.2-1","45~beta-1","46.0-1","46.0-2","46.1-1","46.2-1","46.3-1","46~alpha-1","46~beta-1","47.0-1","47.2-1","47~beta-1","47~rc-1","48.0-1","48.1-1","48.2-1","48.3-1","48.3-2","48.5-1","48.5-2","48.5-3","48~beta-1","48~rc-1","48~rc-2","49.0-1","49.1-1","49.2-1","49.2-2","49.2-3","50.3-1","50.3-2","50.4-1","50.4-2","51~rc-1"]},{"source":"osv","ecosystem":"Debian:13","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.3-2","48.5-0+deb13u1","48.5-1","48.5-2","48.5-3","49.0-1","49.1-1","49.2-1","49.2-2","49.2-3","50.3-1","50.3-2","50.4-1","50.4-2","51~rc-1"]},{"source":"osv","ecosystem":"Debian:14","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"51~rc-1"}]}],"versions":["48.3-2","48.5-1","48.5-2","48.5-3","49.0-1","49.1-1","49.2-1","49.2-2","49.2-3","50.3-1","50.3-2","50.4-1","50.4-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.3-1ubuntu1","3.18.0-1ubuntu2","3.18.1-1ubuntu1","3.18.3-0ubuntu1","3.18.5-0ubuntu1","3.18.5-0ubuntu1.1","3.18.10-0ubuntu1","3.18.11-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.1-1ubuntu1","3.26.1-1ubuntu2","3.26.1-1ubuntu4","3.26.5.1-1ubuntu1","3.27.90-1ubuntu1","3.28.0.1-1ubuntu1","3.28.1-1ubuntu1","3.28.5-0ubuntu1","3.28.6-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-1","3.34.1-1build1","3.36.0-1","3.36.1-1","3.36.2-0ubuntu1","3.36.3-0ubuntu1","3.36.4-0ubuntu1","3.36.4-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["41.0-1","41.0-2","41.2-1","41.3-1","42~beta-1","42.0-1","42.1-1","42.1-1ubuntu1","42.4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["45.0-1","45.1-1","46~alpha-1","46~beta-1","46.0-1","46.0-2build1","46.5-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["49.2-3ubuntu1","50.4-1","50.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"epiphany-browser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.5-3","49.1-1","49.2-1","49.2-2","49.2-3","49.2-3ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"epiphany","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"51.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"epiphany","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.5-bp160.2.1"}]}],"bundled":2}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77682","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-77682","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77682","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2147","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-94291","tags":["web"]},{"url":"https://bugzilla.suse.com/1275932","tags":["report"]},{"url":"https://bugzilla.suse.com/1276758","tags":["report"]}],"sources":{"osv":[{"id":"DEBIAN-CVE-2026-77682","status":"published","published":"2026-08-22T14:47:38.497434435Z","modified":"2026-09-03T16:00:07.023046718Z","updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"openSUSE-SU-2026:12361-1","title":"epiphany-51.1-1.1 on GA media","description":"These are all security issues fixed in the epiphany-51.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-30T00:00:00Z","modified":"2026-10-31T18:00:05.939295492Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:22199-1","title":"Security update for epiphany","description":"This update for epiphany fixes the following issues:\n\nChanges in epiphany:\n\n- CVE-2026-77679: path traversal in WebExtension XPI extraction\n    (ZIP slip) (bsc#1276758)\n- CVE-2026-77682: JavaScript code injection in autofill via\n  unsanitized CSS selector from element id (bsc#1275932)\n","status":"published","published":"2026-10-28T15:37:12Z","modified":"2026-11-01T17:23:30.219127025Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"UBUNTU-CVE-2026-77682","description":"[Use a user message to trigger form autofill]","status":"published","published":"2026-08-27T00:00:00Z","modified":"2026-10-17T13:01:07.877842634Z","updated_at":"2026-11-02T16:57:18.015985Z"}]}}