51.2 - October 29, 2026
=======================

* Bugs fixed:
  - #2961 WebApp Epiphany Argument Injection with data URI (Michael Catanzaro)
  - #2966 Crash when restoring first pinned tab (grewal)
  - #2969 Making a tag with an empty name and removing it crashes GNOME Web
    (Arak)
  - #2971 Unresponsive page dialog reappears even after page became responsive
    again (Adrián Pérez de Castro)
  - #2972 HTML injection in Epiphany Reader mode (Fernando Munoz)
  - #2976 (CVE-2026-118598) Allowing a Clipboard or Website-Data-Access prompt
    grants camera AND microphone access (John Cardullo)
  - #2978 (CVE-2026-115683) TLS/SSL Error Page Bypass
    window.webkit.messageHandlers.tlsErrorPage (Michael Catanzaro)
  - #2981 Epiphany installs XPI extensions even when the Web Extensions feature
    is disabled (Fernando Munoz)
  - #2988 (CVE-2026-118599) XPI extraction allows hard-link targets -  TAR .xpi
    overwrites an existing user file (Fernando Munoz)
  - #2989 Epiphany loads installed WebExtensions when the feature is disabled
    (Fernando Munoz)
  - !2202 Do not focus location entry when opening web URIs (John Cardullo)
  - !2230 reader: Escape reading time before inserting it into the page (Michael
    Catanzaro)

* Translation updates:
  - Chinese (Taiwan) (Cheng-Chia Tseng)
  - Greek, Modern (1453-) (Efstathios Iosifidis)
  - Maori (Aidan Tuhoro-Bell)
  - Norwegian Bokmål (Kjartan Maraas)