CVE-2021-45086: Debian Linux

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Affected products

• Debian Debian Linux: version 11.0 only
• Gnome Epiphany: before 40.4 (fixed in 40.4); from 41.0, before 41.1 (fixed in 41.1)

Published 2021-12-16. Last modified 2026-06-17.