CVE-2026-77682

Name of the Vulnerable Software and Affected Versions Epiphany (affected versions not specified)

Description A flaw exists in the form autofill script where the browser fails to escape an HTML form element ID before interpolating it into a CSS selector. A malicious website can provide a crafted ID containing a payload that, when triggered by the autofill mechanism, allows arbitrary code execution within the browser's private script environment. This environment contains save handlers and credential APIs, which could allow an attacker to silently exfiltrate saved passwords.

Recommendations Disable browser autofill entirely.