Installed web extensions appear to have access to api from "ephy.js" rather than "webextentions.js"
Installed web extensions have access to api from "ephy.js" (of which is if I understand correctly is for internal use), rather than "webextentions.js".
I understand that this will likely be fixed by !968 (closed), but if i understand what is written in #1443 (closed) correctly this is somewhat of a security hazard. (Even as an experimental feature)
I have attached an extension which should demonstrate the issue. It just on page load calls both:
Ephy.getAppleMobileWebAppCapable()
and window.browser.runtime.getBrowserInfo()
and attempts to log the results to the console.
The first function called gives a return (in every case I have observed false
), whilst the latter fails due to window.browser.runtime
being undefined
.
Epiphany version: 42.0 (flatpak)
Webkit version: 2.36.0
OS version: Fedora 35, Gnome 41.5