On Fedora Workstation, GNOME, Epiphany, and WebKitGTK
I don’t often write useless blog posts, but today will be an exception. The address sanitizer (asan) is a ludicrously good tool. The developers deserve a huge thank you.
There are other good sanitizers too, but asan is what I have been using recently.
Thank you!
If you use Epiphany Technology Preview, please update immediately and ensure you have revision 3.29.2-26 or newer. We discovered and resolved a vulnerability that allowed websites to access internal Epiphany features and thereby exfiltrate passwords from the password manager. We apologize for this oversight.
The unstable Epiphany 3.29.2 release is the only affected release. Epiphany 3.29.1 is not affected. Stable releases, including Epiphany 3.28, are also not affected.
There is no reason to believe that the issue was discovered or exploited by any attackers, but you might wish to change your passwords if you are concerned.