GNOME 50.5 security fixes patch a gvfs CVE and Epiphany code injection

GNOME has released version 50.5, closing a security gap in the gvfs file-system component, a code-injection bug in the Epiphany browser, and a use-after-free flaw in the librsvg image-rendering library. The update touches 22 modules in total, and the GNOME Release Team is urging every distribution running GNOME 50 to pull in the new packages.

Epiphany moves from 50.4 to 50.6, folding in two earlier point releases. One of them stops JavaScript from being injected through a CSS selector used in the autofill feature, and also fixes a path-traversal issue in WebExtension XPI archives (a ZIP slip bug that could let a malicious extension drop files outside its intended folder). The other adds proper quoting to command-line arguments before Epiphany passes them to a shell.

gvfs 1.60.3 carries the one named vulnerability in this release, CVE-2026-88924, fixed by having the admin backend set socket ownership before the socket is created — though GNOME's notes give no severity rating for it.

librsvg 2.62.4 patches a use-after-free triggered by duplicate XML entities inside nested XInclude documents, alongside Rust dependency updates addressing RUSTSEC-2026-0187 and RUSTSEC-2026-0204. The login manager GDM also gets fixes for two use-after-free bugs — one capable of crashing an entire session during screen lock/unlock — plus a regression that had broken systemd authentication after a prior security patch.