Bugs fixed:
- #2961 WebApp Epiphany Argument Injection with data URI (Michael Catanzaro)
- #2966 Crash when restoring first pinned tab (grewal)
- #2969 Making a tag with an empty name and removing it crashes GNOME Web (Arak)
- #2971 Unresponsive page dialog reappears even after page became responsive again (Adrián Pérez de Castro)
- #2972 HTML injection in Epiphany Reader mode (Fernando Munoz)
- #2976 (CVE-2026-118598) Allowing a Clipboard or Website-Data-Access prompt grants camera AND microphone access (John Cardullo)
- #2978 (CVE-2026-115683) TLS/SSL Error Page Bypass window.webkit.messageHandlers.tlsErrorPage (Michael Catanzaro)
- #2981 Epiphany installs XPI extensions even when the Web Extensions feature is disabled (Fernando Munoz)
- #2988 (CVE-2026-118599) XPI extraction allows hard-link targets - TAR .xpi overwrites an existing user file (Fernando Munoz)
- #2989 Epiphany loads installed WebExtensions when the feature is disabled (Fernando Munoz)
- !2202 Do not focus location entry when opening web URIs (John Cardullo)
- !2230 reader: Escape reading time before inserting it into the page (Michael Catanzaro)
Updated translations for: Chinese (Taiwan), Greek, Modern (1453-), Maori, Norwegian Bokmål.
