CVE catalog

CVE-2021-45085

epiphany-browser: CVE-2021-45085

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.61% · Oct 25, 2026

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianepiphany-browsersid51.1-1fixed
Debianepiphany-browserforky51.1-1fixed
Debianepiphany-browsertrixie48.5-0+deb13u1fixed
Debianepiphany-browserbookworm43.1-1fixed
Ubuntuepiphany-browser20.043.34.1-1vulnerable
Ubuntuepiphany-browser20.043.34.1-1build1vulnerable
Ubuntuepiphany-browser20.043.36.0-1vulnerable
Ubuntuepiphany-browser20.043.36.1-1vulnerable
Ubuntuepiphany-browser20.043.36.2-0ubuntu1vulnerable
Ubuntuepiphany-browser20.043.36.3-0ubuntu1vulnerable
Ubuntuepiphany-browser20.043.36.4-0ubuntu1vulnerable
Ubuntuepiphany-browser20.043.36.4-0ubuntu2fixed
Ubuntuepiphany-browser22.0441.0-1vulnerable
Ubuntuepiphany-browser22.0441.0-2vulnerable
Ubuntuepiphany-browser22.0441.2-1vulnerable
Ubuntuepiphany-browser22.0441.3-1vulnerable
Ubuntuepiphany-browser22.0442~beta-1vulnerable
Ubuntuepiphany-browser22.0442.0-1vulnerable
Ubuntuepiphany-browser22.0442.1-1vulnerable
Ubuntuepiphany-browser22.0442.1-1ubuntu1fixed
Ubuntuepiphany-browser16.043.16.3-1ubuntu1vulnerable
Ubuntuepiphany-browser16.043.18.0-1ubuntu2vulnerable
Ubuntuepiphany-browser16.043.18.1-1ubuntu1vulnerable
Ubuntuepiphany-browser16.043.18.3-0ubuntu1vulnerable
Ubuntuepiphany-browser16.043.18.5-0ubuntu1vulnerable
Ubuntuepiphany-browser16.043.18.5-0ubuntu1.1vulnerable
Ubuntuepiphany-browser16.043.18.10-0ubuntu1vulnerable
Ubuntuepiphany-browser16.043.18.11-0ubuntu1vulnerable
Ubuntuepiphany-browser18.043.26.1-1ubuntu1vulnerable
Ubuntuepiphany-browser18.043.26.1-1ubuntu2vulnerable
Ubuntuepiphany-browser18.043.26.1-1ubuntu4vulnerable
Ubuntuepiphany-browser18.043.26.5.1-1ubuntu1vulnerable
Ubuntuepiphany-browser18.043.27.90-1ubuntu1vulnerable
Ubuntuepiphany-browser18.043.28.0.1-1ubuntu1vulnerable
Ubuntuepiphany-browser18.043.28.1-1ubuntu1vulnerable
Ubuntuepiphany-browser18.043.28.5-0ubuntu1vulnerable
Ubuntuepiphany-browser18.043.28.6-0ubuntu1vulnerable
Ubuntuepiphany-browser20.043.34.1-1vulnerable
Ubuntuepiphany-browser20.043.34.1-1build1vulnerable
Ubuntuepiphany-browser20.043.36.0-1vulnerable
Ubuntuepiphany-browser20.043.36.1-1vulnerable
Ubuntuepiphany-browser20.043.36.2-0ubuntu1vulnerable
Ubuntuepiphany-browser20.043.36.3-0ubuntu1vulnerable
Ubuntuepiphany-browser20.043.36.4-0ubuntu1vulnerable
Ubuntuepiphany-browser20.043.36.4-0ubuntu2fixed
Opensuseepiphanytumbleweed41.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianepiphany-browsersourcesid41.2-1not yet assignedNot reportedNot reported
Debianepiphany-browsersourceforky41.2-1not yet assignedNot reportedNot reported
Debianepiphany-browsersourcetrixie41.2-1not yet assignedNot reportedNot reported
Debianepiphany-browsersourcebookworm41.2-1not yet assignedNot reportedNot reported
Ubuntuepiphany-browserdeb20.043.36.4-0ubuntu2Not reportedUSN-5561-1Not reported
Ubuntuepiphany-browserdeb22.0442.1-1ubuntu1Not reportedUSN-5561-1Not reported
Ubuntuepiphany-browserdeb20.043.36.4-0ubuntu2Not reportedUBUNTU-CVE-2021-45085Not reported
Opensuseepiphanyrpmtumbleweed41.2-1.1Not reportedOPENSUSE-SU-2024:11690-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [epiphany-branding-upstream]Unknown

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · noarch · tumbleweed

      Unknown · Fixed: 41.2-1.1

      Version impact unknown

      dsa · epiphany · opensuse · tumbleweed

  • [epiphany-lang]Unknown

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · noarch · tumbleweed

      Unknown · Fixed: 41.2-1.1

      Version impact unknown

      dsa · epiphany · opensuse · tumbleweed

  • [gnome-shell-search-provider-epiphany]Unknown

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 41.2-1.1

      Version impact unknown

      dsa · epiphany · opensuse · tumbleweed

  • [epiphany]Fixed

    Source package: [epiphany]

    Details (1)

    • 50.6-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 41.2-1.1

      dsa · epiphany · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [epiphany-browser]Fixed
    Details (2)

    • 43.1-1 · amd64 · bookworm

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · bookworm; dsa · epiphany-browser · debian · 12

    • 43.1-1 · arm64 · bookworm

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · bookworm; dsa · epiphany-browser · debian · 12

  • [epiphany-browser-data]Fixed

    Source package: [epiphany-browser]

    Details (2)

    • 43.1-1 · all · bookworm

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · bookworm; dsa · epiphany-browser · debian · 12

    • 43.1-1 · all · bookworm

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · bookworm; dsa · epiphany-browser · debian · 12

[Debian 13 (Trixie)]

  • [epiphany-browser]Fixed
    Details (2)

    • 48.5-0+deb13u1 · amd64 · trixie

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · 13

    • 48.5-0+deb13u1 · arm64 · trixie

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · 13

  • [epiphany-browser-data]Fixed

    Source package: [epiphany-browser]

    Details (2)

    • 48.5-0+deb13u1 · all · trixie

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · 13

    • 48.5-0+deb13u1 · all · trixie

      Fixed · Fixed: 41.2-1

      dsa · epiphany-browser · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]