High [CVE-2026-77682] JavaScript code injection in autofill via unsanitized CSS selector from element id

A code injection vulnerability exists in Epiphany when the user invokes form autofill from the context menu on a page containing a malicious HTML form.

In embed/web-process-extension/resources/js/ephy_autofill.js, getSelector() builds a CSS selector by directly interpolating an element's id attribute: path.unshift(`#${el.id}`); When the user selects an autofill entry, the browser process in embed/ephy-web-view.c previously constructed JavaScript using sprintf with the selector embedded in single quotes: EphyAutofill.fill(PAGE_ID, 'SELECTOR', FILL_CHOICE); Because SELECTOR comes from attacker-controlled page content and is not escaped, a crafted id such as a'); PAYLOAD; var _=(' breaks out of the string literal and executes arbitrary JavaScript when the script is evaluated.

The injected code runs in Epiphany's private autofill script world, which hosts EphyAutofill credential APIs and password manager save/request handlers. The reporter demonstrated a proof of concept that injects credentials into another domain and uses Ephy.permissionsManager to enumerate domains with special permissions.

Full exfiltration of all saved passwords was not demonstrated but may be possible given the privileges of this context. Exploitation requires the victim to visit a malicious page, right-click on a form field, and choose an Autofill context menu item.